MikroTik

Pleaase i need assistance. I'm using a bridge interface on my mikrotik mant. I notice that client can see my mac address and ip when they view neighbours. How can I disable that on my bridge interface. I have tried using filters on bridge interface but it still not working. Please help me.

You can't block that. There was a recent discussing about that. There are postings in front and after it:

viewtopic.php?f=21&t=133533&hilit=Neigh ... 00#p656739

Do you mean when your client goes in IP > NEIGHBOR and see your MAC and IP?
If that's it, you can disable the discover:

Hi:

Do you mean when your client goes in IP > NEIGHBOR and see your MAC and IP?
If that's it, you can disable the discover:

Code: Select all

/ip neighbor discovery set bridge-interface discover=no

that's true, and you can block those packets with a firewall rule too (LLDP works with UDP/5678).

Hi:

Do you mean when your client goes in IP > NEIGHBOR and see your MAC and IP?
If that's it, you can disable the discover:

Code: Select all

/ip neighbor discovery set bridge-interface discover=no

that's true, and you can block those packets with a firewall rule too (LLDP works with UDP/5678).

how to block those packet with a firewall rule?
i set this "/ip firewall filter add chain=output action=drop src-port=5678 protocol=udp" but doesn't work ROS 6.44.3

You can't do it with ip firewall. It works only with bridge filter. That means you must have the nterface in bridge, even if it is a single port bridge

yep you're right... seems like that allow rule that I've configured in my firewall is useless ; however there's a new way of blocking neighbors directly at the /ip neighbors discovery-interface, using interface-lists, the steps are first add a new list named as you want (deny-mndp, it's my example); then you'll need to add interfaces at that list and finally you can set up a discovery rule by matching that interface list.

The commands will be like:

/interface list add name=deny-mndp
/interface list member add interface=bridge list=deny-mndp
/ip neighbor discovery-settings set discover-interface-list=!deny-mndp