Forum

Saudações

Estou trabalhado em um projeto para proteger toda minha rede com 2.300 cliente em bridge

criei regras para bloqueio de portas em minha rb's que estão na rua.

/interface bridge
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no forward-delay=15s l2mtu=1598 max-message-age=20s mtu=1500 name="Bridge SN" priority=0x8000 protocol-mode=stp transmit-hold-count=6
/interface bridge filter
add action=accept chain=forward comment="Permissao de comincacao da WAN com as demais." disabled=no in-interface=ether1 out-interface=ether2
add action=accept chain=forward disabled=no in-interface=ether1 out-interface=ether3
add action=accept chain=forward disabled=no in-interface=ether1 out-interface=ether4
add action=accept chain=forward disabled=no in-interface=ether1 out-interface=ether5
add action=drop chain=forward comment="Bloqueio de comunicacao entre a ether2 com as outras ecessao da wan" disabled=no in-interface=ether2 out-interface=ether2
add action=drop chain=forward disabled=no in-interface=ether2 out-interface=ether3
add action=drop chain=forward disabled=no in-interface=ether2 out-interface=ether4
add action=drop chain=forward disabled=no in-interface=ether2 out-interface=ether5
add action=drop chain=forward comment="Bloqueio de comunicacao entre a ether3 com as outras ecessao da wan" disabled=no in-interface=ether3 out-interface=ether2
add action=drop chain=forward disabled=no in-interface=ether3 out-interface=ether3
add action=drop chain=forward disabled=no in-interface=ether3 out-interface=ether4
add action=drop chain=forward disabled=no in-interface=ether3 out-interface=ether5
add action=drop chain=forward comment="Bloqueio de comunicacao entre a ether4 com as outras ecessao da wan" disabled=no in-interface=ether4 out-interface=ether2
add action=drop chain=forward disabled=no in-interface=ether4 out-interface=ether3
add action=drop chain=forward disabled=no in-interface=ether4 out-interface=ether4
add action=drop chain=forward disabled=no in-interface=ether4 out-interface=ether5
add action=drop chain=forward comment="Bloqueio de comunicacao entre a ether5 com as outras ecessao da wan" disabled=no in-interface=ether5 out-interface=ether2
add action=drop chain=forward disabled=no in-interface=ether5 out-interface=ether3
add action=drop chain=forward disabled=no in-interface=ether5 out-interface=ether4
add action=drop chain=forward disabled=no in-interface=ether5 out-interface=ether5
add action=drop chain=forward comment=Netbios disabled=no dst-port=135-139 ip-protocol=tcp mac-protocol=ip
add action=drop chain=forward disabled=no dst-port=135-139 ip-protocol=udp mac-protocol=ip
add action=drop chain=forward disabled=no dst-port=445-449 ip-protocol=tcp mac-protocol=ip
add action=drop chain=forward disabled=no dst-port=445-449 ip-protocol=udp mac-protocol=ip
add action=drop chain=input comment="Bloqueio de Dhcp" disabled=no in-interface=ether2 ip-protocol=udp mac-protocol=ip src-port=67
add action=drop chain=input disabled=no in-interface=ether3 ip-protocol=udp mac-protocol=ip src-port=67
add action=drop chain=input disabled=no in-interface=ether4 ip-protocol=udp mac-protocol=ip src-port=67
add action=drop chain=input disabled=no in-interface=ether5 ip-protocol=udp mac-protocol=ip src-port=67

elas aceitarão a comunicação da ether1 com a 2,3,4,5 mas a 2 nao enchergar e 3,4,5 e assim por diante

/ip firewall filter
add chain=forward src-mac-address=aa:bb:cc:dd:ee:ff action=drop

bloqueia o mac do radio que o cliente inverteu o cabo e está jogando na dhcp rede.

eu teste essa regra no firewall filter teve sucesso eu queria agora arrumar um jeito da rb marcar os mac's que estao jogando dhcp pelo alerts e bloquear automaticamente alguem ja fes isto