Page 1 of 1

DNS Allow Remote Requests

Posted: Mon Dec 03, 2012 6:50 pm
by hci
If under DNS cache you do not have "Allow Remote Requests" checked, and the router LAN is assigned 192.168.1.1, dhcp clients to the router are assigned out of 192.168.1.0/24 and router receives DNS servers from PPPoE will the clients be able to use the DNS cache on 192.168.1.1?

I do see the docs but still am not sure.

http://wiki.mikrotik.com/wiki/Manual:IP/DNS

What does "Allow Remote Requests" exactly change?

Re: DNS Allow Remote Requests

Posted: Mon Dec 03, 2012 7:07 pm
by BinaryCrash
Allow Remote Requests:

enabled = Will be a DNS Server, responding to dns requests.
disabled = Will be a DNS Client, not responding to dns request. Used only for local dns resolve. (the mikrotik itself)

Re: DNS Allow Remote Requests

Posted: Mon Dec 03, 2012 7:20 pm
by hci
So it would likely be a good idea to do this to protect the DNS cache if "Allow Remote Requests" is enabled?

/ip firewall filter
add action=drop chain=input dst-port=53 protocol=udp src-address=!192.168.1.0/24

or

/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=pppoe-out1 protocol=udp

Re: DNS Allow Remote Requests

Posted: Fri Dec 07, 2012 12:12 am
by BinaryCrash
Yes, you should block others from using your DNS Server and enable only your network to use it. Using filters, like you said.

Re: DNS Allow Remote Requests

Posted: Fri Jan 18, 2019 8:37 pm
by anav
Not so fast.........
It depends upon the fiilter rules in place.
For example I have drop all else rules at the end and work on the principle of - if its not permitted its dropped.

So my input rules are as such.....
add action=accept chain=input comment="Allow LAN DNS queries-UDP" dst-port=53 \
in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Allow LAN DNS queries - TCP" dst-port=\
53 in-interface-list=LAN protocol=tcp

Any other traffic on port 53 will be dropped by my last rule.
add action=drop chain=input comment="DROP ALL ELSE"

If you want to be slightly more paranoid you could always add these rules in the forward chain BEFORE
the first accept, established rule............
add action=drop chain=forward comment="Drop LAN DNS queries-UDP" dst-port=53 \
in-interface-list=WAN protocol=udp
add action=drop chain=forward comment="Drop LAN DNS queries - TCP" dst-port=\
53 in-interface-list=WAN protocol=tcp

However since I have a drop all else rule in my forward chain as the last rule, I dont think I need this.

Re: DNS Allow Remote Requests

Posted: Sat Jan 19, 2019 5:41 am
by pegasus123
you replied to a post from 2012

Re: DNS Allow Remote Requests

Posted: Sat Jan 19, 2019 12:34 pm
by anav
I need the practice LOL.

Re: DNS Allow Remote Requests

Posted: Tue Apr 20, 2021 11:38 pm
by robmaltsystems
I need the practice LOL.

I often feel that when programming RouterOS. I love the power but boy does it make my head hurt sometimes.

Re: DNS Allow Remote Requests

Posted: Tue May 11, 2021 11:44 am
by Ishtiaque
add action=drop chain=input

By this command you will lost router Access.