MikroTik router: How to disallow internet access for one PC?
up vote
2
down vote
favorite
I have connected 2 PCs (PC-1 and PC-2) to my MikroTik hEX (RB750Gr3).
I want to disallow internet access only for PC-2 (PC-1 and other connected devices should have internet access).
But I want to be able to connect from PC-1 to PC-2 and vice versa (for example: on PC-2 is running some server and I want that server accessible from PC-1). In other words: For PC-2 allow access only for LAN. How to do this?
Thanks for answer.
router internet firewall lan mikrotik-routeros
edited Dec 3 at 19:07
Duncan X Simpson
1,083821
asked Mar 29 '17 at 6:29
Lukas
11615
add a comment |
up vote
2
down vote
favorite
I have connected 2 PCs (PC-1 and PC-2) to my MikroTik hEX (RB750Gr3).
I want to disallow internet access only for PC-2 (PC-1 and other connected devices should have internet access).
But I want to be able to connect from PC-1 to PC-2 and vice versa (for example: on PC-2 is running some server and I want that server accessible from PC-1). In other words: For PC-2 allow access only for LAN. How to do this?
Thanks for answer.
router internet firewall lan mikrotik-routeros
edited Dec 3 at 19:07
Duncan X Simpson
1,083821
asked Mar 29 '17 at 6:29
Lukas
11615
Hi, have you been able to check the answers to mark one as accepted?
– Efren
Jul 18 at 1:00
Of course, done.
– Lukas
Jul 18 at 6:24
add a comment |
up vote
2
down vote
favorite
up vote
2
down vote
favorite
I have connected 2 PCs (PC-1 and PC-2) to my MikroTik hEX (RB750Gr3).
I want to disallow internet access only for PC-2 (PC-1 and other connected devices should have internet access).
But I want to be able to connect from PC-1 to PC-2 and vice versa (for example: on PC-2 is running some server and I want that server accessible from PC-1). In other words: For PC-2 allow access only for LAN. How to do this?
Thanks for answer.
router internet firewall lan mikrotik-routeros
edited Dec 3 at 19:07
Duncan X Simpson
1,083821
asked Mar 29 '17 at 6:29
Lukas
11615
I have connected 2 PCs (PC-1 and PC-2) to my MikroTik hEX (RB750Gr3).
I want to disallow internet access only for PC-2 (PC-1 and other connected devices should have internet access).
But I want to be able to connect from PC-1 to PC-2 and vice versa (for example: on PC-2 is running some server and I want that server accessible from PC-1). In other words: For PC-2 allow access only for LAN. How to do this?
Thanks for answer.
router internet firewall lan mikrotik-routeros
router internet firewall lan mikrotik-routeros
edited Dec 3 at 19:07
Duncan X Simpson
1,083821
asked Mar 29 '17 at 6:29
Lukas
11615
edited Dec 3 at 19:07
Duncan X Simpson
1,083821
asked Mar 29 '17 at 6:29
Lukas
11615
edited Dec 3 at 19:07
Duncan X Simpson
1,083821
edited Dec 3 at 19:07
Duncan X Simpson
1,083821
edited Dec 3 at 19:07
Duncan X Simpson
1,083821
1,083821
asked Mar 29 '17 at 6:29
Lukas
11615
asked Mar 29 '17 at 6:29
Lukas
11615
asked Mar 29 '17 at 6:29
Lukas
11615
11615
Hi, have you been able to check the answers to mark one as accepted?
– Efren
Jul 18 at 1:00
Of course, done.
– Lukas
Jul 18 at 6:24
add a comment |
Hi, have you been able to check the answers to mark one as accepted?
– Efren
Jul 18 at 1:00
Of course, done.
– Lukas
Jul 18 at 6:24
Hi, have you been able to check the answers to mark one as accepted?
– Efren
Jul 18 at 1:00
Hi, have you been able to check the answers to mark one as accepted?
– Efren
Jul 18 at 1:00
Of course, done.
– Lukas
Jul 18 at 6:24
Of course, done.
– Lukas
Jul 18 at 6:24
add a comment |
2 Answers
2
active
oldest
votes
up vote
3
down vote
accepted
This can be translated almost directly to firewall rules:
/ip firewall filter {
allow from PC-2 to LAN:
add chain=forward src-address=<PC2_IP> dst-address=<LAN_SUBNET> action=accept
deny from PC-2 to everywhere else:
add chain=forward src-address=<PC2_IP> action=reject
Which can also be combined:
deny from PC to not-LAN:
add chain=forward src-address=<PC2_IP> dst-address=!<LAN_SUBNET> action=reject
}
Here <LAN_SUBNET> should be the prefix you want to allow, e.g. 192.168.88.0/24 for the IPv4 rule, or 2001:db8:abcd:0::/64 for IPv6.
The rule checking goes from top to bottom until first match, so make sure the rule goes after "allow established" but before any "allow everything" rules you might have.
Note: Within the same subnet, access will always be allowed, as communications only go through the built-in switch and don't reach the OS. (Although RouterOS allows overriding that if necessary – under /interface ethernet switch rule, you can find an option to redirect packets from PC-2 to the OS as well. However, it's generally best to assume that intra-subnet traffic is unfiltered.)
edited Apr 10 '17 at 3:21
Duncan X Simpson
1,083821
answered Mar 29 '17 at 6:41
grawity
230k35486544
Sorry for late reply, works great. Thank you.
– Lukas
Jul 18 at 6:23
add a comment |
up vote
3
down vote
In addition to what @grawity said, make sure to make PC-2's DHCP lease static. You also have to determine the threat level. If PC-2 is used by someone who is technically skilled, then you'll want to prevent the router from auto-adding ARP from broadcasts, and set the DHCP server to Add ARP for leases. This will prevent them from using a static IP to bypass.
Now that I think about it, the easier solution would be to just filter based on MAC address:
/ip firewall filter add chain=forward src-mac-address=XX:XX:XX:XX:XX:XX dst-address=!X.X.X.X/XX action=reject
answered Apr 9 '17 at 23:43
Duncan X Simpson
1,083821
I like the solution based on MAC address. Thanks for answer! I appreciate it.
– Lukas
Apr 11 '17 at 5:55
MAC address based filtering could also be easily bypassed by a technically skilled user.
– bcs78
Jul 25 at 11:19
@bcs78 That's true; this just makes it harder. I knew how to set a static before I knew how to spoof a MAC.
– Duncan X Simpson
Jul 25 at 15:37
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1193426%2fmikrotik-router-how-to-disallow-internet-access-for-one-pc%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
3
down vote
accepted
This can be translated almost directly to firewall rules:
/ip firewall filter {
allow from PC-2 to LAN:
add chain=forward src-address=<PC2_IP> dst-address=<LAN_SUBNET> action=accept
deny from PC-2 to everywhere else:
add chain=forward src-address=<PC2_IP> action=reject
Which can also be combined:
deny from PC to not-LAN:
add chain=forward src-address=<PC2_IP> dst-address=!<LAN_SUBNET> action=reject
}
Here <LAN_SUBNET> should be the prefix you want to allow, e.g. 192.168.88.0/24 for the IPv4 rule, or 2001:db8:abcd:0::/64 for IPv6.
The rule checking goes from top to bottom until first match, so make sure the rule goes after "allow established" but before any "allow everything" rules you might have.
Note: Within the same subnet, access will always be allowed, as communications only go through the built-in switch and don't reach the OS. (Although RouterOS allows overriding that if necessary – under /interface ethernet switch rule, you can find an option to redirect packets from PC-2 to the OS as well. However, it's generally best to assume that intra-subnet traffic is unfiltered.)
edited Apr 10 '17 at 3:21
Duncan X Simpson
1,083821
answered Mar 29 '17 at 6:41
grawity
230k35486544
Sorry for late reply, works great. Thank you.
– Lukas
Jul 18 at 6:23
add a comment |
up vote
3
down vote
accepted
This can be translated almost directly to firewall rules:
/ip firewall filter {
allow from PC-2 to LAN:
add chain=forward src-address=<PC2_IP> dst-address=<LAN_SUBNET> action=accept
deny from PC-2 to everywhere else:
add chain=forward src-address=<PC2_IP> action=reject
Which can also be combined:
deny from PC to not-LAN:
add chain=forward src-address=<PC2_IP> dst-address=!<LAN_SUBNET> action=reject
}
Here <LAN_SUBNET> should be the prefix you want to allow, e.g. 192.168.88.0/24 for the IPv4 rule, or 2001:db8:abcd:0::/64 for IPv6.
The rule checking goes from top to bottom until first match, so make sure the rule goes after "allow established" but before any "allow everything" rules you might have.
Note: Within the same subnet, access will always be allowed, as communications only go through the built-in switch and don't reach the OS. (Although RouterOS allows overriding that if necessary – under /interface ethernet switch rule, you can find an option to redirect packets from PC-2 to the OS as well. However, it's generally best to assume that intra-subnet traffic is unfiltered.)
edited Apr 10 '17 at 3:21
Duncan X Simpson
1,083821
answered Mar 29 '17 at 6:41
grawity
230k35486544
Sorry for late reply, works great. Thank you.
– Lukas
Jul 18 at 6:23
add a comment |
up vote
3
down vote
accepted
up vote
3
down vote
accepted
This can be translated almost directly to firewall rules:
/ip firewall filter {
allow from PC-2 to LAN:
add chain=forward src-address=<PC2_IP> dst-address=<LAN_SUBNET> action=accept
deny from PC-2 to everywhere else:
add chain=forward src-address=<PC2_IP> action=reject
Which can also be combined:
deny from PC to not-LAN:
add chain=forward src-address=<PC2_IP> dst-address=!<LAN_SUBNET> action=reject
}
Here <LAN_SUBNET> should be the prefix you want to allow, e.g. 192.168.88.0/24 for the IPv4 rule, or 2001:db8:abcd:0::/64 for IPv6.
The rule checking goes from top to bottom until first match, so make sure the rule goes after "allow established" but before any "allow everything" rules you might have.
Note: Within the same subnet, access will always be allowed, as communications only go through the built-in switch and don't reach the OS. (Although RouterOS allows overriding that if necessary – under /interface ethernet switch rule, you can find an option to redirect packets from PC-2 to the OS as well. However, it's generally best to assume that intra-subnet traffic is unfiltered.)
edited Apr 10 '17 at 3:21
Duncan X Simpson
1,083821
answered Mar 29 '17 at 6:41
grawity
230k35486544
This can be translated almost directly to firewall rules:
/ip firewall filter {
allow from PC-2 to LAN:
add chain=forward src-address=<PC2_IP> dst-address=<LAN_SUBNET> action=accept
deny from PC-2 to everywhere else:
add chain=forward src-address=<PC2_IP> action=reject
Which can also be combined:
deny from PC to not-LAN:
add chain=forward src-address=<PC2_IP> dst-address=!<LAN_SUBNET> action=reject
}
Here <LAN_SUBNET> should be the prefix you want to allow, e.g. 192.168.88.0/24 for the IPv4 rule, or 2001:db8:abcd:0::/64 for IPv6.
The rule checking goes from top to bottom until first match, so make sure the rule goes after "allow established" but before any "allow everything" rules you might have.
Note: Within the same subnet, access will always be allowed, as communications only go through the built-in switch and don't reach the OS. (Although RouterOS allows overriding that if necessary – under /interface ethernet switch rule, you can find an option to redirect packets from PC-2 to the OS as well. However, it's generally best to assume that intra-subnet traffic is unfiltered.)
edited Apr 10 '17 at 3:21
Duncan X Simpson
1,083821
answered Mar 29 '17 at 6:41
grawity
230k35486544
edited Apr 10 '17 at 3:21
Duncan X Simpson
1,083821
edited Apr 10 '17 at 3:21
Duncan X Simpson
1,083821
edited Apr 10 '17 at 3:21
Duncan X Simpson
1,083821
1,083821
answered Mar 29 '17 at 6:41
grawity
230k35486544
answered Mar 29 '17 at 6:41
grawity
230k35486544
answered Mar 29 '17 at 6:41
grawity
230k35486544
230k35486544
Sorry for late reply, works great. Thank you.
– Lukas
Jul 18 at 6:23
add a comment |
Sorry for late reply, works great. Thank you.
– Lukas
Jul 18 at 6:23
Sorry for late reply, works great. Thank you.
– Lukas
Jul 18 at 6:23
Sorry for late reply, works great. Thank you.
– Lukas
Jul 18 at 6:23
add a comment |
up vote
3
down vote
In addition to what @grawity said, make sure to make PC-2's DHCP lease static. You also have to determine the threat level. If PC-2 is used by someone who is technically skilled, then you'll want to prevent the router from auto-adding ARP from broadcasts, and set the DHCP server to Add ARP for leases. This will prevent them from using a static IP to bypass.
Now that I think about it, the easier solution would be to just filter based on MAC address:
/ip firewall filter add chain=forward src-mac-address=XX:XX:XX:XX:XX:XX dst-address=!X.X.X.X/XX action=reject
answered Apr 9 '17 at 23:43
Duncan X Simpson
1,083821
I like the solution based on MAC address. Thanks for answer! I appreciate it.
– Lukas
Apr 11 '17 at 5:55
MAC address based filtering could also be easily bypassed by a technically skilled user.
– bcs78
Jul 25 at 11:19
@bcs78 That's true; this just makes it harder. I knew how to set a static before I knew how to spoof a MAC.
– Duncan X Simpson
Jul 25 at 15:37
add a comment |
up vote
3
down vote
In addition to what @grawity said, make sure to make PC-2's DHCP lease static. You also have to determine the threat level. If PC-2 is used by someone who is technically skilled, then you'll want to prevent the router from auto-adding ARP from broadcasts, and set the DHCP server to Add ARP for leases. This will prevent them from using a static IP to bypass.
Now that I think about it, the easier solution would be to just filter based on MAC address:
/ip firewall filter add chain=forward src-mac-address=XX:XX:XX:XX:XX:XX dst-address=!X.X.X.X/XX action=reject
answered Apr 9 '17 at 23:43
Duncan X Simpson
1,083821
I like the solution based on MAC address. Thanks for answer! I appreciate it.
– Lukas
Apr 11 '17 at 5:55
MAC address based filtering could also be easily bypassed by a technically skilled user.
– bcs78
Jul 25 at 11:19
@bcs78 That's true; this just makes it harder. I knew how to set a static before I knew how to spoof a MAC.
– Duncan X Simpson
Jul 25 at 15:37
add a comment |
up vote
3
down vote
up vote
3
down vote
In addition to what @grawity said, make sure to make PC-2's DHCP lease static. You also have to determine the threat level. If PC-2 is used by someone who is technically skilled, then you'll want to prevent the router from auto-adding ARP from broadcasts, and set the DHCP server to Add ARP for leases. This will prevent them from using a static IP to bypass.
Now that I think about it, the easier solution would be to just filter based on MAC address:
/ip firewall filter add chain=forward src-mac-address=XX:XX:XX:XX:XX:XX dst-address=!X.X.X.X/XX action=reject
answered Apr 9 '17 at 23:43
Duncan X Simpson
1,083821
In addition to what @grawity said, make sure to make PC-2's DHCP lease static. You also have to determine the threat level. If PC-2 is used by someone who is technically skilled, then you'll want to prevent the router from auto-adding ARP from broadcasts, and set the DHCP server to Add ARP for leases. This will prevent them from using a static IP to bypass.
Now that I think about it, the easier solution would be to just filter based on MAC address:
/ip firewall filter add chain=forward src-mac-address=XX:XX:XX:XX:XX:XX dst-address=!X.X.X.X/XX action=reject
answered Apr 9 '17 at 23:43
Duncan X Simpson
1,083821
answered Apr 9 '17 at 23:43
Duncan X Simpson
1,083821
answered Apr 9 '17 at 23:43
Duncan X Simpson
1,083821
answered Apr 9 '17 at 23:43
Duncan X Simpson
1,083821
1,083821
I like the solution based on MAC address. Thanks for answer! I appreciate it.
– Lukas
Apr 11 '17 at 5:55
MAC address based filtering could also be easily bypassed by a technically skilled user.
– bcs78
Jul 25 at 11:19
@bcs78 That's true; this just makes it harder. I knew how to set a static before I knew how to spoof a MAC.
– Duncan X Simpson
Jul 25 at 15:37
add a comment |
I like the solution based on MAC address. Thanks for answer! I appreciate it.
– Lukas
Apr 11 '17 at 5:55
MAC address based filtering could also be easily bypassed by a technically skilled user.
– bcs78
Jul 25 at 11:19
@bcs78 That's true; this just makes it harder. I knew how to set a static before I knew how to spoof a MAC.
– Duncan X Simpson
Jul 25 at 15:37
I like the solution based on MAC address. Thanks for answer! I appreciate it.
– Lukas
Apr 11 '17 at 5:55
I like the solution based on MAC address. Thanks for answer! I appreciate it.
– Lukas
Apr 11 '17 at 5:55
MAC address based filtering could also be easily bypassed by a technically skilled user.
– bcs78
Jul 25 at 11:19
MAC address based filtering could also be easily bypassed by a technically skilled user.
– bcs78
Jul 25 at 11:19
@bcs78 That's true; this just makes it harder. I knew how to set a static before I knew how to spoof a MAC.
– Duncan X Simpson
Jul 25 at 15:37
@bcs78 That's true; this just makes it harder. I knew how to set a static before I knew how to spoof a MAC.
– Duncan X Simpson
Jul 25 at 15:37
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1193426%2fmikrotik-router-how-to-disallow-internet-access-for-one-pc%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Hi, have you been able to check the answers to mark one as accepted?
– Efren
Jul 18 at 1:00
Of course, done.
– Lukas
Jul 18 at 6:24