Hello,
I've bought recentst a assembled RB493G with RouterOs 5.18 preinstalled. It took some time to configure it, but I've succeeded
Now I want to block port 25 for the hotspot users. I've tried several rules but they are all ignored.
Anyone an idea how to get this working.
Re: Block port 25 with hotspot
Just found out that the hotspot creates two dynamic nat rules with dst port 25 and jump to chain hs-smtp. These seem to overrule a forward filter i'm using.
If I remove the dynamic rules, it's working. But afther a reboot the rules are back in place.
Any one a solution for this?
If I remove the dynamic rules, it's working. But afther a reboot the rules are back in place.
Any one a solution for this?
Re: Block port 25 with hotspot
The most basic rule is this. If you want to only block it for a specific interface, you can always specify the appropriate in-interface.
Code: Select all
/ip firewall filter
add chain=forward action=drop dst-port=25 protocol=tcp
Re: Block port 25 with hotspot
I'm trying to blok this port only from my hotspot, when using your rule it's blocking this port also from my normal lan network.The most basic rule is this. If you want to only block it for a specific interface, you can always specify the appropriate in-interface.
Code: Select all/ip firewall filter add chain=forward action=drop dst-port=25 protocol=tcp
Code: Select all
/ip firewall filter
chain=forward action=drop protocol=tcp src-address=10.5.50.0/24 dst-port=25
Re: Block port 25 with hotspot
What dynamic rules are you referring too specifically? The only ones that are generated for SMTP are in NAT, not in the filter section. If you could provide a more complete diagram of your network we would be able to help a lot more.
You can also narrow down the rule by specifying the in-interface to the interface of your hotspot.
You can also narrow down the rule by specifying the in-interface to the interface of your hotspot.
Re: Block port 25 with hotspot
Your last tip has done the job!!!!!!!.What dynamic rules are you referring too specifically? The only ones that are generated for SMTP are in NAT, not in the filter section. If you could provide a more complete diagram of your network we would be able to help a lot more.
You can also narrow down the rule by specifying the in-interface to the interface of your hotspot.
Code: Select all
/ip firewal filter
add chain=forward action=drop protocol=tcp in-interface=wlan2 dst-port=25 comment="Block port 25 for hotspot users"
Added rules (filter and NAT) to protect my local network from hotspot users.
And with your help added a filter to block port 25 for hotspot users.
Thanks!!!!!