Only devices that got an IP from DHCP (or are listed) can use the network; fake ARP and self-assigned IPs do not work.

With ARP reply-only the router only talks to the IP–MAC pairs in its ARP table. The DHCP server adds that entry for every client, static-IP devices are listed by hand. Bridge horizon stops customers on different ports from sending each other fake ARP.

• List the PC/laptop you manage the router from first (or connect by MAC Winbox): after reply-only, a device that is not in the ARP table cannot reach the router.
• Static-IP devices that are not listed will lose access: that is the point for rogue static IPs.
• RouterOS 7.25+ also has Layer 2 security features in Bridge (covered in the video); this ARP reply-only method also works on older versions.

How to use: Copy the script, open Winbox → New Terminal, paste. Or Download .rsc, upload it in Files, then run /import file-name=anti-netcut.rsc.

RouterOS v6 / v7 · added 10 November 2026