I have Mikrotik RBcAP2n with one lan i one wlan. Wlan WiFi is for clients and Lan is for ADSL. Between MKRB and ADSL I have one server on the same network as MKRB and ADSL. Server have apache web site and server acts as my DMZ.



IPs for network between ADSL,Server and MKRB is 172.16.0.x

IP for ADSL is

IP for MKRB is

IP for Server is

IPs for network on wlan interface on MKRB is for clients 192.168.0.x

Now, if I want to block internet for specific IPs-Clients on WiFi side of MKRB but allow, for the same clients, traffic to DMZ, how can I achieve this?

For instance, if client have ip, MKRB wlan have ip

How to block internet for client but allow him to access to


How to block all Public IPs for client but allow him to access to network

Thanks for suggestions.


I'm surprised that nobody has answered you on this question. Look this

/ip firewall filter

add chain=forward src-address= dst-address=! action=drop

That is it for now. See you another time.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.