I have two networks Network 1 and Network 2 shown in the picture, and one client machine that must access resources on both networks. Due to security reasons the two networks must be isolated from each other. I have only basic understanding of networking and am complete newbie to Mikrotiks. How do I configure the router to support this configuration? I understand that this scenario is like having 2 ISPs, but I cannot figure out how to configure the routes so that each gateway is used only to access it's own resources. Network Schema



assign the correct IPs to each interface, for example

/ip address add interface=ether1 address=
/ip address add interface=ether2 address=
/ip address add interface=ether3 address=

(not sure about the /24 masks, you have to adapt to your real network)

by default, mikrotik does automatic routing, so you just have to block traffic between network1 and network2

/ip firewall filter chain=prerouting src-address= dst-address= action=drop
/ip firewall filter chain=prerouting src-address= dst-address= action=drop

so traffic between net1 and net2 is blocked but traffic between net1/net2 and operator is allowed. Of course you will have to add the correct routes on all the devices, for example for operator, if it's a windows system

route add mask
route add mask
  • Do I need to configure mangle firewall rules to handle proper back routing of packets from the operator? – Tigran Topchyan Nov 24 '15 at 13:21
  • no mangle needed, "proper back routing of packets" will be fine if the operator has the correct routes installed. – Benoit PHILIPPON Nov 25 '15 at 13:40

You should be able to put in ACLs on the interfaces for Network 1 and Network 2 to prevent those two networks from talking to each other. The ACLs should permit everything else, so your Operator can access both networks with no problem.

Not the answer you're looking for? Browse other questions tagged or ask your own question.