I'm not sure I'm going about this the right way....

I have 3 static IP's from my ISP that are all in the same subnet with the same gateway. One address is used for the router (RB3011 - 6.43.8) on a bridge, ports 1-3. ISP is plugged into port 1. Ports 2 and 3 are for a webserver and an email server. LAN is on port 5 and a seperate LAN for my workbench (customer's equipment) is on a bridge using ports 6-8.

I cannot get IP-Filter rules to work. I'd like to set filter rules to only allow traffic to designated ports on the web server and email server while blocking all ports to the LAN subnets.

what am I doing wrong?

/interface bridge

add name=bridge1-Internet

add name=bridge2-WorkRoom

/interface wireless security-profiles

set [ find default=yes ] supplicant-identity=MikroTik

/tool user-manager customer

set admin access=own-routers,own-users,own-profiles,own-limits,config-payment-gw

/interface bridge port

add bridge=bridge1-Internet interface=ether1

add bridge=bridge1-Internet interface=ether2

add bridge=bridge1-Internet interface=ether3

add bridge=bridge2-WorkRoom interface=ether6

add bridge=bridge2-WorkRoom interface=ether7

add bridge=bridge2-WorkRoom interface=ether8

/interface bridge settings

set use-ip-firewall=yes

/ip address

add address= interface=ether5 network=

add address= interface=bridge2-WorkRoom network=

add address= interface=bridge1-Internet network=

/ip firewall filter

add action=accept chain=input connection-state=established,related in-


add action=accept chain=input dst-address= dst-port=25,80,443,995

in-interface=bridge1-Internet protocol=tcp

add action=accept chain=input in-interface=bridge1-Internet protocol=icmp

add action=drop chain=input in-interface=bridge1-Internet

/ip firewall nat

add action=masquerade chain=srcnat out-interface=bridge1-Internet

add action=dst-nat chain=dstnat dst-address= dst-port=80

protocol=tcp to-addresses=

/ip route

add distance=1 gateway=

/tool user-manager database

set db-path=user-manager

  • I gave up trying to make this work. I went back to using one interface for the WAN and assigning all three addresses to it. Then I used NAT rules to forward traffic to the appropriate server.... – com-guy Mar 31 '19 at 0:47

It's because set use-ip-firewall=yes 'Force bridged traffic to also be processed by prerouting, forward and postrouting sections of IP routing' (Bridge_Settings)

Using bridge is like using hardware switch with 4 ports (isp-eth2-eth3-router) before your router. add action=accept chain=input dst-address= dst-port=25,80,443,995 in-interface=bridge1-Internet protocol=tcp - this rule allow tcp for router and take no effect inside bridge.

| improve this answer | |
  • I thought "set use-ip-firewall=yes" would let the traffic on the bridge be processed by the "ip-firewall-filter rules"? – com-guy Apr 2 '19 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.