2

I have two networks Network 1 and Network 2 shown in the picture, and one client machine that must access resources on both networks. Due to security reasons the two networks must be isolated from each other. I have only basic understanding of networking and am complete newbie to Mikrotiks. How do I configure the router to support this configuration? I understand that this scenario is like having 2 ISPs, but I cannot figure out how to configure the routes so that each gateway is used only to access it's own resources. Network Schema

gvhfghj

3

assign the correct IPs to each interface, for example

/ip address add interface=ether1 address=10.191.4.192/24
/ip address add interface=ether2 address=10.100.4.100/24
/ip address add interface=ether3 address=192.168.10.1/24

(not sure about the /24 masks, you have to adapt to your real network)

by default, mikrotik does automatic routing, so you just have to block traffic between network1 and network2

/ip firewall filter chain=prerouting src-address=10.191.4.0/24 dst-address=10.100.4.0/24 action=drop
/ip firewall filter chain=prerouting src-address=10.100.4.0/24 dst-address=10.191.4.0/24 action=drop

so traffic between net1 and net2 is blocked but traffic between net1/net2 and operator is allowed. Of course you will have to add the correct routes on all the devices, for example for operator, if it's a windows system

route add 10.191.4.0 mask 255.255.255.0 192.168.10.1
route add 10.100.4.0 mask 255.255.255.0 192.168.10.1
| improve this answer | |
  • Do I need to configure mangle firewall rules to handle proper back routing of packets from the operator? – Tigran Topchyan Nov 24 '15 at 13:21
  • no mangle needed, "proper back routing of packets" will be fine if the operator has the correct routes installed. – Benoit PHILIPPON Nov 25 '15 at 13:40
0

You should be able to put in ACLs on the interfaces for Network 1 and Network 2 to prevent those two networks from talking to each other. The ACLs should permit everything else, so your Operator can access both networks with no problem.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.