Mikrotik router and the DoH cache server cannot connect to internet when using double WAN and route-mark toghether

RouterOS General
1

Hello thanks for your time ,I have some serious issues with DoH and internet of the mikrotik device it self …

1) When using two Wan connections on two different networks , mikrotik’s DNS and internet connection will be locked out , actually when using (routing-mark) option on (/ip/route) if I disable even one of the routing-mark options ,the router will be connected to internet and the DNS cache server will work no problem. here is the thing I want to use the router as DNS Cache server and use one of the two WAN connections as gateway of the DNS lookup when the other is down and vice versa so my config is here :slight_smile: :

/ip route
add distance=2 gateway=PPPoE-ADSL routing-mark=ADSL-RouteMark
add distance=1 gateway=... routing-mark=Radio-RouteMark --------> SOLVED only the 2nd persists now

  1. I’m trying to use DoH specially #NextDNS but it won’t work no matter what I do ,like : flushing DNS of the router - disabling one of the route-mark mentioned above ,installing certificates from (https://dns.nextdns.io/) and (https://curl.se/ca/cacert.pem) and NTP is enabled (/system sntp client set enabled=yes primary-ntp=132.163.97.1 secondary-ntp=132.163.97.1) but the DoH just won’t work :confused:

/ip dns static add name=dns.nextdns.io address=45.90.28.0 type=A
/ip dns static add name=dns.nextdns.io address=45.90.30.0 type=A
/ip dns static add name=dns.nextdns.io address=2a07:a8c0:: type=AAAA
/ip dns static add name=dns.nextdns.io address=2a07:a8c1:: type=AAAA
/ip dns set use-doh-server=“https://dns.nextdns.io/******” verify-doh-cert=yes
BTW my device os version is : 7.10.1
here are the error log of DoH :
“DoH server connection error: SSl:internal error (6)
DNS: DoH Server connection error: SSL:internal error (6)”

If there is a work around please let me know … :smiley: :smiley:

2

I actually fixed the first problem by adding exactly the commands mentioned in the first problem but with no route-mark so basically they are duplicate but without the route-mark option …
Only the second issue exists now ..
Tnx alot for your attention :sunglasses:

3

and also forgot to tell you guys i’ve added NAT rule to redirect the dns inbound traffic

/ip firewall nat add chain=dstnat action=redirect protocol=udp dst-port=53
/ip firewall nat add chain=dstnat action=redirect protocol=tcp dst-port=53

4

dude should I enable normal DNS when using DoH ? Becuase in most of my researches they recommended me to “disable and remove ip v4 and ip v6 DNS in order to be able to use DoH” on mikrotik devices but this mikrotik manual tells me otherwise ? I actually did it and got no feedback other than normal DNS is being used becuase of the lack of DoH … I’m so confused :frowning:
and this is the Mikroitk YT channel I used during impelmetation of DoH on my device https://www.youtube.com/watch?v=w4erB0VzyIE
23.png