Community discussions

MikroTik App
 
D3L05
newbie
Topic Author
Posts: 28
Joined: Tue Feb 09, 2010 1:54 am

isolate bridge ports

Tue Aug 24, 2010 5:45 pm

Hi,

I've this setup:


pppoe server---------switch---------rb493[bridged ether1,2,3,4,5,6...](from ether2 to ether9 UBNT rockets as wds bridge where the clients connect)

some clients, some times, can't authenticate in the pppoe server, like packets lost before reach the pppoe server.

so how can I do the traffic (in rb493) only goes from ether1 to etherx, and from etherx to ether1


thanks!
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 7186
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: isolate bridge ports

Fri Aug 27, 2010 9:30 am

set up bridge filters to block communication between ports except etherx and ether1
 
D3L05
newbie
Topic Author
Posts: 28
Joined: Tue Feb 09, 2010 1:54 am

Re: isolate bridge ports

Fri Aug 27, 2010 5:57 pm

something like this could work?
add chain=forward action=drop in-interface=!ether1 out-interface=!ether1
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: isolate bridge ports

Fri Aug 27, 2010 6:10 pm

It should, as long as you turn on the IP firewall on the bridge.
 
D3L05
newbie
Topic Author
Posts: 28
Joined: Tue Feb 09, 2010 1:54 am

Re: isolate bridge ports

Fri Aug 27, 2010 6:13 pm

thanks,

the idea is to do something like private vlans, where ether1 do the job as the uplink port
 
blake
Member
Member
Posts: 426
Joined: Mon May 31, 2010 10:46 pm
Location: Arizona

Re: isolate bridge ports

Fri Aug 27, 2010 8:29 pm

the idea is to do something like private vlans, where ether1 do the job as the uplink port
Its not possible to emulate private VLANs on MikroTik. The closest thing to it is creating a separate VLAN for each customer…each with its own /30 subnet.

If you want the L2 separation of each customer while still allowing them to share the same IP subnet, use Cisco. ;-)
 
JorgeAmaral
Trainer
Trainer
Posts: 199
Joined: Wed Mar 04, 2009 11:53 pm
Location: /ip route add type=blackhole

Re: isolate bridge ports

Sun Aug 29, 2010 1:46 am

You can/should use split-horizon on the bridge ports.

Read here: http://wiki.mikrotik.com/wiki/MPLSVPLS# ... n_bridging

Best regards,

Jorge Amaral
 
D3L05
newbie
Topic Author
Posts: 28
Joined: Tue Feb 09, 2010 1:54 am

Re: isolate bridge ports

Sun Aug 29, 2010 1:56 am

thanks Jorge,

using split horizon, in my setup, I should set for example horizon 1 for ether2-ether9 and horizon 2 for ether1, is that correct?


thanks
 
JorgeAmaral
Trainer
Trainer
Posts: 199
Joined: Wed Mar 04, 2009 11:53 pm
Location: /ip route add type=blackhole

Re: isolate bridge ports

Sun Aug 29, 2010 2:08 am

yes, you are correct.

Best regards,

Jorge Amaral
 
wifi442
Frequent Visitor
Frequent Visitor
Posts: 82
Joined: Tue Jan 12, 2010 11:01 pm

Re: isolate bridge ports

Sun Aug 29, 2010 7:35 am

Hi,

I've this setup:


pppoe server---------switch---------rb493[bridged ether1,2,3,4,5,6...](from ether2 to ether9 UBNT rockets as wds bridge where the clients connect)

some clients, some times, can't authenticate in the pppoe server, like packets lost before reach the pppoe server.

so how can I do the traffic (in rb493) only goes from ether1 to etherx, and from etherx to ether1


thanks!
What symptoms are you having? Occasional dropped pppoe sessions? I have a similar layout to yours with rockets. I am getting random packet loss from the RB450G to the rockets connected via lan cable. Netwatch reports drops every now and again, maybe 2 or 3 times a day. My pppoe server at the main office loses some of the clients every so oftern and it usually coincides with the packets that are lost.

My RB450G is set up as a bridge with all ports bridged.
 
D3L05
newbie
Topic Author
Posts: 28
Joined: Tue Feb 09, 2010 1:54 am

Re: isolate bridge ports

Sun Aug 29, 2010 8:16 pm

my problem is similar, the worst thing is, the clients sometime can't connect, the nanostations show
ppp not connected, but no error in the log (nanostation or pppoe server)
 
wifi442
Frequent Visitor
Frequent Visitor
Posts: 82
Joined: Tue Jan 12, 2010 11:01 pm

Re: isolate bridge ports

Mon Aug 30, 2010 5:20 am

my problem is similar, the worst thing is, the clients sometime can't connect, the nanostations show
ppp not connected, but no error in the log (nanostation or pppoe server)
Interesting, I am just losing packets, mostly from the RB50G to the directly connected Main Ubnt Rocket Dish. That dish links back to the office where the pppoe server and the internet pipe are. Everyone's sessions stay connected most of the time. Only every other day does the packet loss kick a session off. So far they are coming back up right away though.

Did you have any luck with the horizon setting?

I am leary to mess with the routerboard until I am in the same room with it. It sits way up on a mountain and wouldn't want to render it unreachable!
 
chm0d755
just joined
Posts: 9
Joined: Mon Dec 31, 2012 2:45 am

Re: isolate bridge ports

Wed Feb 13, 2013 1:05 am

I will test port isolate in the following way:

[admin@MikroTik] > interface bridge filter print
Flags: X - disabled, I - invalid, D - dynamic

0 chain=forward out-interface=!ether5 action=drop in-interface=ether1

1 chain=forward out-interface=!ether5 action=drop in-interface=ether2

2 chain=forward out-interface=!ether5 action=drop in-interface=ether3

3 chain=forward out-interface=!ether5 action=drop in-interface=ether4

All 5 ports are common Bridge - "bridge1"
 
samansenju
just joined
Posts: 23
Joined: Thu Oct 23, 2014 10:35 am

Re: isolate bridge ports

Thu Jan 22, 2015 1:31 am

hi folks...



can you give me some example .. rules of brdge filtering, to fillter loop between bridge ?

what protocol or port causing loop usually ? i will drop it, and what happen/effect if i drop it ?

Who is online

Users browsing this forum: bsiege, chinhbq, majestic, mojojojo, yhfung and 25 guests