Hello,
I just learning mikrotik recently. I have internet connection from ISP Provider through a modem,
then this modem connect to mikrotik, and from mikrotik connect to AP
example:
modem 192.168.30.1 ( and public ip 30.30.30.30 ), just example because public ip dynamic
mikrotik 192.168.88.1
LAN 192.168.88.2 - 192.168.88.254 ( DHCP from mikrotik )
I can change setting/config for modem using http://192.168.30.1 or https://30.30.30.30. The problem is I can't change superuser credential for this modem
Is it possible to block access from LAN to http://192.168.30.1 or https://30.30.30.30 ? If possible please tell me
Thanks, and sorry for my english
-
-
Revelation
Member
- Posts: 336
- Joined:
Re: Disallow LAN to access configuration of modem using Mikrotik
A simple firewall rule denying traffic to the destination IP will suffice.
Re: Disallow LAN to access configuration of modem using Mikrotik
According to http://forum.mikrotik.com/viewtopic.php?t=31994
I have tried
But same result, that ip address still accesible through LAN
I have tried
Code: Select all
/ip firewall filter add chain=input src-address=192.168.30.1 action=drop
Re: Disallow LAN to access configuration of modem using Mikrotik
make two changes to your rule
/ip firewall filter add chain=forward dst-address=192.168.30.1 action=drop
/ip firewall filter add chain=forward dst-address=192.168.30.1 action=drop
Re: Disallow LAN to access configuration of modem using Mikrotik
Thanks all,
Finally I got this work.
Like TroyQ said chain=forward, placed on the top of all forward-accept rule (my mistake, placed on the bottom).
And for public ip. I am using this scipt named "public_ip"
Add one more rule same like private ip, but this time using src address list = "MY-PUBLIC-IP".
Then running with scheduler every 10 minutes to check public ip if changed
on Event
Finally I got this work.
Like TroyQ said chain=forward, placed on the top of all forward-accept rule (my mistake, placed on the bottom).
And for public ip. I am using this scipt named "public_ip"
Code: Select all
{
/tool fetch url="http://myip.dnsomatic.com/" mode=http dst-path=mypublicip.txt
local ip [file get mypublicip.txt contents ]
put $ip
/ip firewall address-list remove [/ip firewall address-list find list="MY-PUBLIC-IP"]
:delay 5
/ip firewall address-list add list=MY-PUBLIC-IP address=$ip
}Then running with scheduler every 10 minutes to check public ip if changed
on Event
Code: Select all
/system script run public_ipWho is online
Users browsing this forum: silverbios, Xman1 and 66 guests