Port Isolation

What this chapter covers

Port Isolation shows how to stop ports on one switch from talking to each other while they still reach a shared uplink.

This is a common need in hotels, shared offices, public access points and hosting. Clients must reach the router, and they must not see one another.

The chapter has two syllabus topics: the RouterOS bridge horizon, and switch port isolation.

After this chapter you should be able to do the following:

• Explain the horizon rule and set the value on bridge ports.
• Design a client and uplink layout that isolates clients and keeps the gateway reachable.
• Compare horizon, chip isolation, VLANs and switch rules.
• Test an isolation design with pings in both directions.
• Explain why Layer 2 isolation does not stop routed traffic.
• Check the offload flag, so you know whether the chip or the CPU does the work.

How the topics fit together

Both topics reach the same goal by different routes.

The bridge horizon is a bridge setting that works on any device. Switch port isolation covers the chip level options, and compares them with VLANs and with switch rules. Whatever the method, the uplink has to stay open.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and example commands.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read the horizon page first, because it is the method you can test on almost any device. Then build a lab with three clients and one uplink, and test with pings in both directions. Look at the offload flags afterwards, so you know whether the CPU was involved.