Webinar topic: Controlling Access Between Devices in the same Layer 2 Segment Presenter: Achmad Mardiansyah In this webinar series, we discussed about Controlling Access Between Devices in the same Layer 2 Segment Please share your feedback or webinar ideas here: http://bit.ly/glcfeedback Check our schedule for future events: https://www.glcnetworks.com/en/schedule/ Follow our social media for updates: Facebook, Instagram, YouTube Channel, and telegram also discord Recording available on Youtube https://youtu.be/nPAT1774zg4

1. www.glcnetworks.com
Controlling Access
Between Devices in
the same Layer 2
Segment
GLC Webinar,
26 May 2022
Achmad Mardiansyah
achmad@glcnetworks.com
GLC Networks, Indonesia

2. www.glcnetworks.com
Agenda
● Introduction
● Review prerequisite knowledge
● Layer 2 communication
● Layer 2 access control
● Live practice
● Q & A
2

3. www.glcnetworks.com
Introduction
3

4. www.glcnetworks.com
What is GLC?
● Garda Lintas Cakrawala (www.glcnetworks.com)
● Based in Bandung, Indonesia
● Areas: Training, IT Consulting
● Certified partner for: Mikrotik, Ubiquity, Linux foundation
● Product: GLC radius manager
● Regular event
4

5. www.glcnetworks.com
Trainer Introduction
● Name: Achmad Mardiansyah
● Base: bandung, Indonesia
● Linux user since 1999, mikrotik user since 2007, UBNT
2011
● Mikrotik Certified Trainer
(MTCNA/RE/WE/UME/INE/TCE/IPv6)
● Mikrotik/Linux Certified Consultant
● Website contributor: achmadjournal.com, mikrotik.tips,
asysadmin.tips
● More info: http://au.linkedin.com/in/achmadmardiansyah
5

6. www.glcnetworks.com
Past experience
● 2020-2022 (Congo DRC, PNG, Malaysia): network support,
radius/billing integration
● 2019, Congo (DRC): build a wireless ISP from ground-up
● 2018, Malaysia: network revamp, develop billing solution and
integration, setup dynamic routing
● 2017, Libya (north africa): remote wireless migration for a new
Wireless ISP
● 2016, United Kingdom: workshop for wireless ISP, migrating a
bridged to routed network
● 2015, Kalimantan, wireless support
● See our website for more details
6

7. www.glcnetworks.com
About GLC webinar?
● First webinar: january 1, 2010 (title: tahun baru
bersama solaris - new year with solaris OS)
● As a sharing event with various topics: linux,
networking, wireless, database, programming,
etc
● Regular schedule
● Irregular schedule: as needed
● Checking schedule:
http://www.glcnetworks.com/schedule
● You are invited to be a presenter
○ No need to be an expert
○ This is a forum for sharing: knowledge, experiences,
information
7

8. www.glcnetworks.com
Please introduce yourself
● Your name
● Your company/university?
● Your networking experience?
● Your mikrotik experience?
● Your expectation from this course?
8

9. www.glcnetworks.com
Prerequisite
● This presentation requires some prerequisite knowledge
● We assume you already know:
○ Networking
○ Mikrotik RouterOS
○ GIT
9

10. www.glcnetworks.com
Review prerequisite knowledge
10

11. www.glcnetworks.com
7 OSI layer & protocol
● OSI layer Is a conceptual model from ISO (International
Standard Organization) for project OSI (Open System
Interconnection)
● When you send a message with a courier, you need to
add more info to get your message arrived at the
destination (This process is called encapsulation)
● What is protocol
○ Is a set of rules for communication
○ Available on each layer
● Communication consist of series encapsulation
○ SDU: service data unit (before PDU)
○ PDU: protocol data unit (after header is added)
11

12. www.glcnetworks.com
Layered model (TCP/IP vs ISO) and encapsulation
12
/ datagram

13. www.glcnetworks.com
Did you notice?
● There is a big overhead on encapsulation process
● More encapsulation means less payload?
13

14. www.glcnetworks.com
Router and Routing
14
● Router is a network device that is used to forward packets, based on layer 3
information (layer 3 header)
● Routing is the process of selecting a path for traffic in a network, or between
or across multiple networks
Physical
router
Router
icon

15. www.glcnetworks.com
Typical connection (physical)
15
R2
R1
R3
● Router connects layer 2 segments
● Router works on layer 3, connecting L2
segments
● Meaning, each layer 2 segment has network
ID

16. www.glcnetworks.com
Typical connection (logical) and routing table
16
Routing table:
● A table at router that is used to forward packet
● Available on every devices (router and host)
● Entry is executed sequentially
192.168.0.0/26
R1
192.168.0.1/26
192.168.0.3/26
192.168.0.2/26
R3
R2
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24
192.168.3.3/24
192.168.3.9/24
192.168.2.9/24
192.168.2.2/24
192.168.1.1/24
192.168.1.9/24
destination gateway
192.168.0.0/26 direct
192.168.1.0/24 direct
192.168.2.0/24 192.168.0.2
192.168.3.0/24 192.168.0.3
192.168.16.3/32 192.168.0.2
0.0.0.0/0 (default gw) 192.168.0.3

17. www.glcnetworks.com
Forwarding packets using routing table
17
● It works like a firewall: match and action
● When a packet arrived, routing table is used to forward packets
● You should think in binary to understand how it works
destination gateway
192.168.16.3/32
11000000 10101000 00001000 00000011
192.168.0.2
192.168.0.0/26
11000000 10101000 00000000 00
direct
192.168.1.0/24
11000000 10101000 00000001
direct
192.168.2.0/24
11000000 10101000 00000010
192.168.0.2
192.168.3.0/24
11000000 10101000 00000011
192.168.0.3
0.0.0.0/0
(no match)
192.168.0.3

18. www.glcnetworks.com
A packet arrived at R1… (example)
18
Destination IP address of the packet is 192.168.2.6, which gateway do we use?
A: 192.168.2.6 = (11000000 10101000 00000010 00000110)
destination gateway
192.168.16.3/32
11000000 10101000 00001000 00000011
192.168.0.2
192.168.0.0/26
11000000 10101000 00000000 00
direct
192.168.1.0/24
11000000 10101000 00000001
direct
192.168.2.0/24
11000000 10101000 00000010
192.168.0.2
192.168.3.0/24
11000000 10101000 00000011
192.168.0.3
0.0.0.0/0 192.168.0.3

19. www.glcnetworks.com
Where routing table lookup happens?
19

20. www.glcnetworks.com
Administrative distance (analogy)
20
20
CITY 1 100 km
CITY 2 120 km
CITY 2 90 km
CITY 3 500 km
CITY 4 250 km
10.10.10.0/24 192.168.0.1 10
10.10.20.0/24 192.168.0.2 12
10.10.20.0/24 192.168.0.3 9
10.10.30.0/24 192.168.0.3 50
10.10.40.0/24 192.168.0.4 25

21. www.glcnetworks.com
Administrative distance
21
● Distance is considered when prefix length is
same
● Lowest distance wins
● Administrative distance policy is depends on
vendor
● Table on the right shows an example of
administrative distance on cisco router

22. www.glcnetworks.com
Static routing
22
● Entries on routing table is created manually
● Admin must manage routing table in all
routers
● Admin have full control
192.168.0.0/26
R1
192.168.0.1/26
192.168.0.3/26
192.168.0.2/26
R3
R2
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24
192.168.3.3/24
192.168.3.9/24
192.168.2.9/24
192.168.2.2/24
192.168.1.1/24
192.168.1.9/24
destination gateway
192.168.0.0/26 direct
192.168.1.0/24 direct
192.168.2.0/24 192.168.0.2
192.168.3.0/24 192.168.0.3
192.168.16.3/32 192.168.0.2
0.0.0.0/0 192.168.0.3

23. www.glcnetworks.com
Dynamic routing
23
● Router will talk to each other with routing protocol (RIP,
OSPF, BGP)
● Entries on routing table is created automatically
● Admin must have a good knowledge about routing
protocol
192.168.0.0/26
R1
192.168.0.1/26
192.168.0.3/26
192.168.0.2/26
R3
R2
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24
192.168.3.3/24
192.168.3.9/24
192.168.2.9/24
192.168.2.2/24
192.168.1.1/24
192.168.1.9/24
destination gateway
192.168.0.0/26 direct
192.168.1.0/24 direct
192.168.2.0/24 192.168.0.2
192.168.3.0/24 192.168.0.3
192.168.16.3/32 192.168.0.2
0.0.0.0/0 192.168.0.3

24. www.glcnetworks.com
Asymmetric routing
24
● Currently, routing is done one-way only
● Forwarding process on router is based on destination IP address
● There is no guarantee incoming path is similar to outgoing path
● We can only control outgoing forwarding
R1
192.168.0.1/26
192.168.0.3/26 R3
R2
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24
192.168.3.3/24
192.168.3.9/24
192.168.2.9/24
192.168.2.2/24
192.168.1.1/24
192.168.1.9/24

25. Firewall concepts
25

26. www.glcnetworks.com
What is Mikrotik firewall?
26
● Is a feature to
○ Control network access (filter)
○ Modify network header (NAT)
○ Marking packet for further processing (mangle)
● Developed from linux
● Consist of 2 parts: matcher & action
● Executed sequentially
● Netadmin must understand the application’s characteristics in order to build a matcher (e.g.
browsing -> using TCP port 80)

27. www.glcnetworks.com
How firewall works?
27
● Setup matcher -> then action
● Mikrotik has lots of options for matcher -> very flexible
● Matcher + Action = Firewall rule
● Rules are executed sequentially

28. www.glcnetworks.com
28
Where the packets are
processed?
A: see packet flow
Note: ipsec is removed in this diagram

29. www.glcnetworks.com
29
FILTER
NAT
MANGLE

30. www.glcnetworks.com
30
What's the difference
between forward and input
chain?
FORWARD
INPUT

31. www.glcnetworks.com
Packet flow diagram since version 6.0 (put all together)
31

32. Layer 2 technology: Ethernet
32

33. www.glcnetworks.com
Ethernet specs
● Defined by IEEE 802.3
● Media:
○ Coaxial cable
○ Twisted pair
○ Fiber optic
● Devices required:
○ Bridge / switch
○ HUB
● Everyone likes it!!
○ Affordable
○ Easy to install
○ Easy maintenance
33

34. www.glcnetworks.com
How ethernet works (CSMA/CD)
● Carrier Sense Multiple Access / Collision
Detection (CSMA/CD)
○ Every host do not know when other send data
○ Before sending data, host check the shared medium
○ Every host only knows when collision happens
● You will have:
○ Collision domain
■ Area where collision happens
■ Can use any frame
○ Broadcast domain
■ Area when broadcast happens
■ Using broadcast frame
● CSMA/CD != CSMA/CA
34

35. www.glcnetworks.com
How ethernet works (ARP)
● ARP = Address resolution protocol
● A mapping between IPv4 and MAC address
● Requires broadcast frame
● Will be eliminated in IPv6
35
Source: ipcisco.com

36. www.glcnetworks.com
Ethernet evolution (1)
36

37. www.glcnetworks.com
Ethernet evolution (2)
37

38. www.glcnetworks.com
Ethernet issue: Collision domain
● Area where collision happens. See CSMA/CD
● Some ideas:
○ Using bridged/switched network
○ Now is very hard to find a HUB
38
Source: devto.com

39. www.glcnetworks.com
Ethernet issue: Broadcast domain
● An area where broadcast happens
● Try use 5-4-3-2-1 rules
● Broadcast can go wild (especially on infected hosts)
● Some ideas:
○ Using router to split segments
○ Port isolation on switch
○ Use storm control on switch
39

40. www.glcnetworks.com
Ethernet issue: Loop
● A condition when frame is forwarded in the media
● Will stop until one of cable is removed
● Some ideas:
○ Do not use traditional switch
○ activate STP between switch
○ Port isolation
40

41. www.glcnetworks.com
Controlling access between devices
41

42. www.glcnetworks.com
Communication between devices in same layer 2 segment
● Router is not involved
● Direct communication between devices
● Traditional switches only checks L2 header (MAC address)
● Use Address Resolution Protocol (ARP)
42

43. www.glcnetworks.com
● Security issues
● Some devices are not allowed to access some devices
● Some devices are infected by malware and try to infect others (very common
cases)
● To improve performance, especially in wireless network
Why controlling communication between devices?
43

44. www.glcnetworks.com
By using mikrotik switch
● Create bridge-local on mikrotik switch,
put all ports into bridge-local
● add firewall rule on bridge
● For maximum benefits, all switches
are mikrotik
44
Source:
praktekit.com

45. www.glcnetworks.com
By using mikrotik router
● Router will activate local-proxy-arp
● Meaning: router will reply all ARP request from
all clients, intercepting traffic
● All internal traffic will go to router first
● Router can add firewall rule to filter traffic
45
R1
ether2

46. www.glcnetworks.com
Live practice
● SSH client
● SSH parameters
○ SSH address
○ SSH port
○ SSH username
○ SSH password
46

47. www.glcnetworks.com
QnA
Any questions?
47

48. www.glcnetworks.com
Interested? Just come to our training...
● Topics are arranged in systematic and
logical way
● You will learn from experienced teacher
● Not only learn the materials, but also
sharing experiences, best-practices, and
networking
48

49. www.glcnetworks.com
End of slides
● Thank you for your attention
● Please submit your feedback: http://bit.ly/glcfeedback
● Find our further event on our website :
https://www.glcnetworks.com
● Like our facebook page:
https://www.facebook.com/glcnetworks
● Slide: https://www.slideshare.net/glcnetworks/
● Discord (bahasa indonesia):
(https://discord.gg/6MZ3KUHHBX )
● Recording (youtube):
https://www.youtube.com/c/GLCNetworks
● Stay tune with our schedule
49