Firewall · Topic 7 of 7

Bridge Filter and Layer 2 Firewalling

Learn how the RouterOS bridge filter checks Ethernet frames at Layer 2, its chains, and how to block rogue DHCP servers, MAC addresses and protocols.

5 min

In a nutshell

The bridge filter works at Layer 2 on frames that cross a bridge.
Its menu is /interface bridge filter.
It has the chains input, output and forward.

What it is

The bridge filter is a firewall for Ethernet frames that cross a bridge.

The IP firewall looks at packets that are routed. Traffic that is only switched inside a bridge does not reach it by default, so a separate Layer 2 filter is needed.

The bridge filter matches MAC addresses, Ethernet protocol types and bridge ports. It can also look at some IP and port fields.

How it works

The bridge filter has its own menu, its own chains and its own rules.

Menu and chains

The rules live under /interface bridge filter. There are three built in chains.

Chain	Frames it sees
input	Frames that are addressed to the bridge itself, meaning the router
output	Frames that the bridge itself sends out
forward	Frames that pass from one bridge port to another

Rules are read from top to bottom, and the first match decides. The same actions as in the IP filter exist, such as accept, drop, log, jump and return.

Useful matchers

Matcher	What it matches
`in-interface`, `out-interface`	The bridge port that received or will send the frame
`in-bridge`, `out-bridge`	The bridge itself
`src-mac-address`, `dst-mac-address`	The MAC address, with an optional mask
`mac-protocol`	The Ethernet type, such as `ip`, `arp` or `ipv6`
`ip-protocol`, `src-port`, `dst-port`	IP details, available when `mac-protocol=ip`

Blocking a rogue DHCP server

A DHCP server answers from UDP port 67. A client port that should never host a server can have these replies dropped.

/interface bridge filter add chain=forward in-interface=ether3 mac-protocol=ip ip-protocol=udp src-port=67 action=drop

Here ether3 is a user port. Any DHCP server reply that enters the bridge from that port is dropped, so a rogue device cannot hand out addresses.

Blocking a MAC address or a protocol

You can block a known bad device, or a protocol that you do not want.

/interface bridge filter add chain=forward src-mac-address=00:11:22:33:44:55/FF:FF:FF:FF:FF:FF action=drop
/interface bridge filter add chain=forward in-interface=ether3 mac-protocol=ipv6 action=drop

The mask FF:FF:FF:FF:FF:FF means that the whole address must match. A mask that covers only the first three bytes, such as FF:FF:FF:00:00:00, matches every address with the same vendor prefix.

Filtering inside a bridge and bridge to IP

A routed packet and a bridged frame take different paths. The IP firewall only sees bridged traffic if you ask for it.

/interface bridge settings set use-ip-firewall=yes

With use-ip-firewall=yes, the IP filter, NAT and mangle rules also see bridged IP traffic. This costs processing power, so use it only if you need it.

Hardware offload

Many devices have a switch chip that forwards frames between ports without the CPU. Frames that are handled by the chip do not reach the bridge filter.

If a bridge filter rule seems to be ignored, check whether the ports are using hardware offload. A port that must be filtered needs to be handled by the CPU.

/interface bridge port print

The H flag in the listing shows that a port is hardware offloaded.

Comparing the two filters

Point	IP filter	Bridge filter
Layer	3	2
Menu	`/ip firewall filter`	`/interface bridge filter`
Matches	IP addresses, ports, states	MAC addresses, Ethernet types, bridge ports
Connection tracking	Yes	No

Exam tip

Use the bridge filter for threats that stay inside one broadcast domain, such as a rogue DHCP server or a spoofed MAC address.

What to remember for the exam

Seven facts summarise the bridge filter.

The bridge filter works at Layer 2 on frames that cross a bridge.
Its menu is /interface bridge filter.
It has the chains input, output and forward.
Forward is for frames passing from one bridge port to another.
It matches MAC addresses, mac-protocol and bridge ports.
use-ip-firewall=yes makes the IP firewall see bridged IP traffic.
Hardware offloaded traffic can bypass the bridge filter.

Common mistakes

Four mistakes appear with bridge filtering.

Using the IP filter for switched traffic. The IP firewall does not see frames that stay inside the bridge unless you enable use-ip-firewall.

Expecting connection tracking. The bridge filter has no connection states, so you cannot match established or new.

Ignoring hardware offload. Offloaded ports bypass the rule, which makes it look as if the filter is broken.

Blocking the wrong direction. A rogue server sends replies from port 67. The rule must match the source port and the port where the device is connected.

Watch out

A wrong bridge filter rule can cut off a whole segment, including your own management path. Keep a console or a safe mode session open.

Check yourself

Work through these three questions.

Which menu holds the bridge filter rules?
The rules are under /interface bridge filter. They work on Ethernet frames at Layer 2.
Which chain handles frames that pass from one bridge port to another?
The forward chain. Input is for frames to the bridge itself and output is for frames that the bridge sends.
How can you make the IP firewall see bridged IP traffic?
Set /interface bridge settings set use-ip-firewall=yes. This costs extra processing power.

Topic 7 of 7 in Firewall

Test yourself on Firewall

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.