Layer 2 Security · Topic 4 of 7

Layer 2 Firewall and Bridge Filter Features

Use the RouterOS bridge filter as a Layer 2 firewall with input, forward and output chains, MAC and protocol matchers, actions, bridge NAT and brouting.

4 min

In a nutshell

The bridge filter works on Ethernet frames, in the chains input, forward and output.
Rules are checked in order, and the first matching rule with a final action decides.
Matchers include MAC addresses, mac-protocol, interfaces and vlan-id.

What it is

The bridge filter is a firewall that works on Ethernet frames instead of IP packets.

It sits inside the bridge and can match MAC addresses, Ethernet types, VLAN IDs, interfaces, and also some IP and ARP fields. It can drop, accept, mark or change the priority of the frames it matches.

You use it where the IP firewall cannot help, for example to block a MAC address or a protocol that is not IP.

How it works

Rules sit in chains, are read in order, and the first match decides.

Chains

Three chains cover the three paths a frame can take.

Chain	Frames covered
`input`	Frames sent to the router itself through a bridge port
`forward`	Frames passing through the bridge between ports
`output`	Frames the router sends out through the bridge

Most rules go in forward, because they control traffic between hosts. The input chain protects the router, and the output chain controls what the router sends.

Common matchers

A rule can match on many properties.

src-mac-address and dst-mac-address, optionally with a mask.
mac-protocol, such as ip, arp, ipv6 or vlan.
in-interface and out-interface for the ports, and in-bridge for the bridge.
vlan-id when the frame is tagged.
For IP frames, src-address, dst-address, ip-protocol and the port numbers.

For IP matchers, set mac-protocol=ip first, because the filter needs to know what the frame carries.

Actions

The action says what to do with a matched frame.

Action	Effect
`accept`	Let the frame pass, and stop checking
`drop`	Discard the frame
`log`	Write to the log, then continue
`set-priority`	Change the 802.1p priority
`mark-packet`	Mark the frame for later use
`jump` and `return`	Move to a custom chain and come back
`passthrough`	Count the frame and continue

Examples

Block a rogue DHCP server on a user port.

/interface bridge filter add chain=forward in-interface=ether3 mac-protocol=ip ip-protocol=udp src-port=67 action=drop

Block all frames from a single MAC address.

/interface bridge filter add chain=forward src-mac-address=00:11:22:33:44:55/FF:FF:FF:FF:FF:FF action=drop

Allow only IP and ARP from a port.

/interface bridge filter add chain=forward in-interface=ether4 mac-protocol=ip action=accept
/interface bridge filter add chain=forward in-interface=ether4 mac-protocol=arp action=accept
/interface bridge filter add chain=forward in-interface=ether4 action=drop

The order matters. The first two rules accept the wanted frames, and the third drops everything else from that port.

Watch out

Bridge filter rules are processed by the CPU. A bridge with hardware offload may lose offload for the traffic these rules touch.

Bridge NAT and brouting

The bridge has two more rule tables.

Bridge NAT changes MAC addresses, with source and destination NAT at Layer 2. It is rare.
Brouting lets selected frames be routed by the router, instead of being bridged.

/interface bridge nat print
/interface bridge broute print

Both are software features used in special designs. They are RouterOS v6 menus, so check that your version still has them before you plan around them.

Using the IP firewall on bridged traffic

The normal IP firewall does not see traffic that is only bridged.

/interface bridge settings set use-ip-firewall=yes

With this setting, bridged IP packets pass through the IP firewall too, so mangle and filter rules apply. It costs CPU, so enable it only when needed. Separate settings exist for VLAN tagged and PPPoE traffic.

Counters and logging

Each rule counts the frames it matches.

/interface bridge filter print stats

Rules at the top that match too much hide the rules below them. Use the counters, and the log action, to see what hits.

Exam tip

Put narrow rules first and broad rules last, and finish a whitelist chain with an explicit drop.

What to remember for the exam

Seven facts cover most questions on this topic.

The bridge filter works on Ethernet frames, in the chains input, forward and output.
Rules are checked in order, and the first matching rule with a final action decides.
Matchers include MAC addresses, mac-protocol, interfaces and vlan-id.
IP matchers need mac-protocol=ip.
Actions include accept, drop, log, set-priority and jump.
Bridge filter rules run on the CPU and can stop hardware offload.
use-ip-firewall=yes sends bridged IP traffic through the IP firewall.

Common mistakes

These four mistakes appear often.

Matching IP fields without mac-protocol=ip. The rule never matches.

Wrong rule order. A broad drop above a narrow accept blocks wanted traffic.

Expecting the IP firewall to see bridged traffic. It needs use-ip-firewall=yes.

Ignoring the CPU cost. Many rules on a busy bridge reduce throughput.

Check yourself

Work through these three questions.

Which chain handles frames that pass between bridge ports?
The forward chain.
Why must mac-protocol=ip be set to match an IP port?
The filter must know the frame carries IP before it can read IP fields.
How do you make the IP firewall see bridged traffic?
Set use-ip-firewall=yes in /interface bridge settings.

Topic 4 of 7 in Layer 2 Security

Test yourself on Layer 2 Security

The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.