When I'm configuring wireless interface in RouterOS or in fact most of APs in general there are basically 2 options for controlling traffic between stations connected to AP - forward all, and don't forward (AP isolation) it's kind of binary...

I'd like to be able to apply some at least a bit more advanced filtering between stations connected to AP. Just like in some routers it's possible to apply some basic firewall on bridge interface level between bridge ports. So lets say I could allow stations to connect with each other only on ssh port, nothing else


Mikrotik RouterOS has embedded "bridge firewall". You can apply filter rules with MAC addresses.

In Bridge menu, Filter and NAT tabs. Yes, NAT.. you can also dst-NAT or SRC-NAT (and many other possibilities). So in your case, you can add some rule to allow traffic between two MAC, and deny all others.

See http://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_Firewall

Update from comment:

Configure your AP with client isolation and add specific stations to the access-list in order to allow communication between them

/interface wireless set [ find name="wlan_foo" ] default-forwarding=no

/interface wireless access-list
add interface=wlan_foo mac-address=BC:85:56:A0:E8:3F forwarding=yes
add interface=wlan_foo mac-address=40:B3:95:31:9A:FB forwarding=yes
  • Well yeah, you can also use IP firewall on bridge. That's not the problem - that's actually what I'd expect from AP. But unfortunately AP doesn't seem to provide similar option (I'm not talking about bridging AP with ether, I'm talking about firewall inside AP itself - I'd like AP to behave like bridge with infinite number of ports with "IP firewall" option enabled. So bridge actually works awesome for me. AP is the problem because it doesn't allow similar control to bridge but if you look at it from functional point of view - they do the same thing - both bridge and AP connect PCs on L2)
    – Lapsio
    May 11 '16 at 18:29
  • Can you provide an exact and detailed example of what you want to achieve ? May 12 '16 at 12:36
  • I'll give an example on MT. When u set master port to none on all interfaces you'll get all interfaces separated on L2 (no communication possible). Then you can add all ports to bridge right? It works more or less like switching but through CPU (lower performance) but on the other hand more control (firewall, stp and stuff). So atm when wifi interface in AP mode has disabled isolation it works like dumb switch. With enabled - there's no communication at all. I'd like to achieve something similar to what CPU bridging provides - more control (lower performance is acceptable).
    – Lapsio
    May 12 '16 at 14:37
  • So in other words - to make AP behave like bridge interface with some filtering, not dumb switch allowing any traffic between stations. Or to achieve this functionality by some tricky setup.
    – Lapsio
    May 12 '16 at 14:39
  • ok, edited my answer with a new solution May 14 '16 at 8:51

I can think of a couple of reasons this may be the case:

  • While there are many brands of Access Point hardware, they all source the wireless chipsets that power them from a handful of manufacturers (Atmel, Broadcom, Intel, Marvell etc.). I would suggest that it's probably an inherent limitation in these chipsets that higher-layer filtering is not supported.

  • There is no presumption in the 802.11 standard that the transport layer is TCP/IPv4 (even if the vast majority is).

Most commercial wireless vendors that I am familiar with (specifically Aruba and Trapeze/Juniper) only enforce L3 ACLs and Firewall policy either at a centralised hardware controller, or virtualised instance of this controller within one of their APs - essentially between the ESSID and the VLAN it attaches to, meaning that WLAN clients can only be controlled with the all-or-nothing approach of AP isolation.

On a somewhat related note - AP Isolation mode works well when you have a single Access Point on your network, but consider what happens when you have two or more and a client roams. Their MAC is now learnt on the uplink interface of the original AP, and will now be able to happily communicate with clients.

This is solved somewhat with "Thin" and clustered "Thick" APs, but stand-alone "Fat" APs can't do much about it.

  • Well yeah I think it's not possible on hardware layer and I'm not expecting it to be implemented in hardware. I don't think bridge as hardware supports L3 firewall either because it's L2 device after all. What RouterOS does is bridging ports via CPU just like linux bridge functionality. So it's above actual switch/bridge it's more like some "L2 routing" done by software. I hoped there's similar thing for APs. What I believe ROS does is returning own MAC when PC is ARPing IP connected to any other bridge port. I'd expect AP to do the same - return router MAC when PC ARPs some IP in own network
    – Lapsio
    May 11 '16 at 18:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.