I am trying hard to figure out how can I force any DHCP client device connects to the port ETH10 on Mikrotik router get assigned a fixed IP-address.

Please note that the device MAC address is unknown and I will not reserve the static IP address binded to a MAC address of the attached device on the router side, in addition the attached devices are set as DHCP client and not possible to offer a static IP.

To clarify more in the following you can find more explanation I have created [on the Mikrotik router] bridge1 with IP range assigned to Eth1,Eth2,Eth3 ports, and all of attached devices to the router's ports Eth1,Eth2,Eth3 gets a dynamic ip address from the router's DCHP server with pool, in addition the ETh1,Eth2,Eth3 attached devices should have access to the internet and their address should always get obtained dynamically from the routers DHCP server.

The problem is as follows, I would like to reserve Port Eth10 on mikrotik to offer only and only and always a static IP address of to any IoT device whose its Ethernet interface is connected to the Router's ETH10, all the ethernet port of the IoT devises are configured as DHCP client and its not possible to change it.

The Mikrotik router should not at all assign a static IP address to the IoT device based on the reserved MAC address of the attached IoT device ethernet interface, since there are many of these IoT devices are going to get attached and then detached later and it is not possible to reserve/store those MAC addresses on the router.

In addition for security reason any IoT device should be reachable from any of the devices connected to the ETH1-ETH3 and vice versa but the IoT device should not get access to the internet at all, while ETH1-ETH3 devices can get access to internet and talk/reach each other.

I have created the DHCP server in the Mikrotik and shared the internet with ETH1-ETH3 devices but I failed to make/assign a static IP address to ETH10 connected device and blocking internet to it. All of my googling offers MAC address based static ip assigning which I have no use for it.

Any guide/settings on how to achieve non-MAC address based static IP assigning and blocking internet on specific IP address in a subnet that works on Mikrotik is appreciated.

  • Did you try to setup multiple DHCP servers on Mikrotik device attached to each one of interface with address pool having only one IP? – mariaczi Jul 11 '18 at 6:03

Set up a separate dhcp server on eth10 which dynamically hands out that single address with a short lease time and no DNS settings.

/ip address add address= interface=eth10
/ip pool add name="iot-static" ranges=
/ip dhcp-server add name="iot-dchp" interface=eth10 lease-time=1m address-pool=iot-static add-arp=yes authoritative=yes use-radius=no
/ip dhcp-server network add address= gateway= netmask=31 dns-none=yes

To block every traffic from IoT devices but allow replies setup a firewall filter rule that blocks new connections from the IoT device:

/ip firewall filter add chain=forward action=reject reject-with=icmp-admin-prohibited connection-state=new src-address= in-interface=eth10 log=no

If you want to block only the internet traffic then use a different filter rule:

/ip firewall filter add chain forward action=reject reject-with=icmp-admin-prohibited src-address= out-interface=eth-internet log=no
| improve this answer | |
  • I have already a DHCP server with pool range & & GW defined + DNS This DHCP server is used with bridge to cover interfaces ether1-ether3 . – Sina S. Jul 12 '18 at 4:27
  • Once I activate the /ip dhcp-server add name="iot-dchp" interface=eth10 lease-time=1m address-pool=iot-static add-arp=yes authoritative=yes use-radius=no It gives static IP to the connected Ether10 client but when it get connected it can not be pinged and the iot MAC address will be detected as all zeros . – Sina S. Jul 12 '18 at 4:40
  • I created and assigned another bridge for the Ether10 and then it worked but the DHCP server for Ether1-Ether3 did not worked. I would like to both of them work. Is something missed with config, shall I use next pool for the iot-static pool or dhcp1_pool, is ARP neccessery to be checked. – Sina S. Jul 12 '18 at 4:40
  • My bad, I overlooked the settings of the DHCP server on the bridge interface. I've modified the IP address settings in my answer. The DHCP server on eth10 has as IP address with /31 subnet now so it won't conflict with the other DHCP server. You should exclude and 115 from the bridge's ip pool to avoid IP address conflicts (pool1 ---> next pool: pool2 ---> next pool: pool3 – bcs78 Jul 12 '18 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.