0

I have two subnets x.x.10.0 and x.x.20.0 running under Mikrotik router so RouterOs GUI, I have set two dhcp on ether2 and on ether3 interfaces a made address pools x.x.10.2 - 254 and x.x.20.2 - 254. I added networks x.x.10.0/24 with gateway x.x.10.1 and x.x.20.0/24 with gateway x.x.20.1. In the leases tab, I can see leases for both of subnets working just fine.

I would like to ask, what am I missing that devices in those two subnets can see the others from the other subnet.

I am thinking I could easily set up firewall for those ether2,3 ports but I thought that different subnets shouldn't see each other by default and that it'd be overkill.

I also thought about the Routes tab, that has automaticly made dynamic records

  1. Dst. address - x.x.10.0/24, gateway - ether2 reachable, pref source - x.x.10.1
  2. Dst. address - x.x.20.0/24, gateway - ether3 reachable, pref source - x.x.20.1

Thanks

6
  • err, I know some networking basic theory, and definitely different subnets should see each other when you have a router. You need a firewall functionality to prevent it. I haven't used a microtik router.. A VLAN switch could perhaps be configured to restrict which ports see which other ports, they sometimes have a router too to enable communication between subnets or VLANs. Routers sometimes in addition to the router functionality, come in a box that has or can have a firewall functionality too. Out of interest, can you put a firewall function on the microtik router?
    – barlop
    Jul 13, 2015 at 10:22
  • Well, thanks. I took it for granted that if I define two new networks than it's impossible to connect to computers in the other network without port forwarding on the router above them Jul 13, 2015 at 10:31
  • Check if you can disable on the DHCP server the feature of sending the default gateway. Without a default gateway a device can't see devices on the other subnets.
    – jcbermu
    Jul 13, 2015 at 10:40
  • If I disable default gateway on DHCP server I cut off internet, @barlop yes I put firewall rules on router for it to work... I just didn't know it was the "right" way to accomplish it... thought it's default behav... Jul 13, 2015 at 11:00
  • @MarkSeygan maybe besides a firewall, another way , would be to look for the routes in the router that enable communication between the subnets and remove those routes. But I guess you'd also want to make sure that the routing table doesn't repopulate
    – barlop
    Jul 13, 2015 at 11:06

1 Answer 1

1

You have an enterprise-grade router, which is fully modular, so unlike with standard consumer-grade internet gateway routers, with yours it is 100% natural for each subnet to see eachother.

To limit access to either subnet, you should use a firewall. Adjusting the default gateway will not help.

If your router supports per-interface routes, you could attempt to remove the routes from eth2 -> x.x.20.x and from eth1 -> x.x.10.x, but this is a lot less explicit than setting up a pair of firewalls inbound on both eth2 and eth3 with a single drop rule, to kill all traffic originating from the other network.

Many routers do not support per-interface routing rules, and Routes are about Destination, not source, so if you killed the dynamic route to x.x.20.0, then traffic coming in over the WAN could never be delivered to that network.

Creating Firewall rulesets on both LAN interfaces is the best bet for your needs.

So, on Eth2, create a firewall ruleset with the following specs:

  Direction: IN
  Default Action: Accept
  Drop from x.x.20.x

and on Eth3:

  Direction: IN
  Default Action: Accept
  Drop from x.x.10.x

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.