2

I have two networks Network 1 and Network 2 shown in the picture, and one client machine that must access resources on both networks. Due to security reasons the two networks must be isolated from each other. I have only basic understanding of networking and am complete newbie to Mikrotiks. How do I configure the router to support this configuration? I understand that this scenario is like having 2 ISPs, but I cannot figure out how to configure the routes so that each gateway is used only to access it's own resources. Network Schema

gvhfghj

closed as off-topic by Ron Maupin Aug 7 '17 at 15:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

2

assign the correct IPs to each interface, for example

/ip address add interface=ether1 address=10.191.4.192/24
/ip address add interface=ether2 address=10.100.4.100/24
/ip address add interface=ether3 address=192.168.10.1/24

(not sure about the /24 masks, you have to adapt to your real network)

by default, mikrotik does automatic routing, so you just have to block traffic between network1 and network2

/ip firewall filter chain=prerouting src-address=10.191.4.0/24 dst-address=10.100.4.0/24 action=drop
/ip firewall filter chain=prerouting src-address=10.100.4.0/24 dst-address=10.191.4.0/24 action=drop

so traffic between net1 and net2 is blocked but traffic between net1/net2 and operator is allowed. Of course you will have to add the correct routes on all the devices, for example for operator, if it's a windows system

route add 10.191.4.0 mask 255.255.255.0 192.168.10.1
route add 10.100.4.0 mask 255.255.255.0 192.168.10.1
  • Do I need to configure mangle firewall rules to handle proper back routing of packets from the operator? – Tigran Topchyan Nov 24 '15 at 13:21
  • no mangle needed, "proper back routing of packets" will be fine if the operator has the correct routes installed. – Benoit PHILIPPON Nov 25 '15 at 13:40
0

You should be able to put in ACLs on the interfaces for Network 1 and Network 2 to prevent those two networks from talking to each other. The ACLs should permit everything else, so your Operator can access both networks with no problem.

Not the answer you're looking for? Browse other questions tagged or ask your own question.