Thank you, so there's no workaround available?If it's the same router that does dstnat for those fake addresses, then it can't work with them, because output packets from router won't go to dstnat chain. I'm wondering where it got address for "mikrotik.com" from...
I just tried "check update" in packages and it says "cannot resolve host", so it can resolve host in ping tool somehow...If it's the same router that does dstnat for those fake addresses, then it can't work with them, because output packets from router won't go to dstnat chain. I'm wondering where it got address for "mikrotik.com" from...
Thanks, but it still not work when it is 4096.DNS cache will hapily cache DNS cahce replies, but you have to allow larger packets (I think that default was already changed to 4096 packet size) That usually fixes dnsec issues.
Could you give me a sample script please? Thank you.Try to use src-nat with dst-nat to guarantee DNS answer passed through the router and then de-nated rightly.
But how? Your previous thread was about making fake addresses and redirecting DNS traffic going to them to another host and non-standard ports. It can work fine when other devices try to access those fake addresses. But when you give same fake DNS resolvers to same router, it can't reach them. Unless some of those addresses was actually reachable somewhere and run DNS resolver. But then the router's DNS cache would work too.Yes, itself can resolve any host, ...
I don't know why, but the ping tool really can resolve any DNS, I tried a lot.But how? Your previous thread was about making fake addresses and redirecting DNS traffic going to them to another host and non-standard ports. It can work fine when other devices try to access those fake addresses. But when you give same fake DNS resolvers to same router, it can't reach them. Unless some of those addresses was actually reachable somewhere and run DNS resolver. But then the router's DNS cache would work too.Yes, itself can resolve any host, ...
/ip firewall mangle
add action=log chain=input protocol=udp src-port=53
add action=log chain=input protocol=tcp src-port=53
Of course not, they are fake addresses.Can you ping the dns servers?
Sent from my Nexus 5 using Tapatalk
It's not the number of records:It shows 17 caches in use but only 2 in the list, ...
cache-used (read-only: integer) displays the current cache size in KiB
He can't, because they don't exist.Can you ping the dns servers?
It only makes sense when you read the other thread linked in first port and understand what he did.