How to deny access to the local network, but not the global one?

Question

Mikrotik

We have a mikrotik router, where eth1=WAN, the rest are connected to the bridge - LAN (192.168.60.1), a dhcp server is raised on the bridge, it distributes at 192.168.60.0/24
We have a keenetic router. Wan port is included in one of the LAN interfaces of the Mikrotik bridge. The kinetics WAN interface receives the address 192.168.60.13 via dhcp. On the lan ports of the kinetics, a dhcp server is raised, stripped to 192.168.1.0/24.

How can I restrict access from devices on the 192.168.1.0/24 subnet to the 192.168.60.0/24 subnet, but let them access the Internet?
tracert shows the route to 192.168.1.1=- 192.168.60.1=- and so on.

Figuratively speaking, I want to achieve a guest network with the Internet, but without access to the local network.

Answer 1

one firewall rule - FORWARD ACCEPT from the address 192.168.60.13/24 to the WAN out-interface,
below it the FORWARD ACCEPT rule from the address 192.168.60.13/24 to the address 192.168.60.1/24
and even lower the FORWARD REJECT rule from the address 192.168.60.13 /24 to 192.168.60.0/24
Seems like enough.

Answer 2

one firewall rule - FORWARD ACCEPT from the address 192.168.60.13/24 to the WAN out-interface,
below it the FORWARD ACCEPT rule from the address 192.168.60.13/24 to the address 192.168.60.1/24
and even lower the FORWARD REJECT rule from the address 192.168.60.13 /24 at 192.168.60.0/24

Answer 3

You can try several options.
1) To score on the kinetics on the WAN interface, assign a static address 192.168.60.2/30, such a mask will not allow the kinetics to forward packets bypassing the Mikrotik, and already on the Mikrotik to resolve access to the firewall.
2) Pull out one port from the bridge on the micro, assign a separate IP addressing, and connect the kineticist there.