hi, following gordian knot problem:

simple two vrf's:
- existing default 'main' for production without services/management
- 'mgmt' for in band management
give the box two ip addresses - one for production, the other one for management:
make two default routes - one for production and the other one for the management:
bind the services used for vrf (other services are disabled):
associate the management vlan '999' to the interface list 'mgmt' to activate the management vrf:

set the dns server to the private management dns server (eg. for sending notification emails etc):

when we try, to check if dns works, following thing happens:
so the dns server doesn't reply or is just not reachable for dns requests.

check, if we can ping the dns-server by it's ip via our management vrf:

without vrf it's not reachable, as it should be, because that's the reason why you make a management vrf (the production gateway doesn't know anything about the isolated management network):

when you use a public reachable dns server, dns suddenly works, but unfortunate only for 'public' addresses:

so clearly dns ALWAYS goes via 'default' main vrf and i found no solution how to force it to go via the mgmt vrf (dns server fields don't accept @mgmt suffix).

Just use main as mgmt.

Just use main as mgmt.

using the vrf 'main' doesn't solve the problem. it's just the wrong way in terms of isolated in-band management.

fact is, that dns is currently not vrf aware, so mikrotik vrf is not usable in real datacenter setups following common best-practice designs.

that's how competitors do it:
https://www.cisco.com/c/en/us/td/docs/i ... e_dns.html

i hope mikrotik will implement this last missing vrf part, too.

Hi,

I have this same problem, and unfortunately it means that my CHR instances cannot refresh their licenses.

Any updates to solving this? I am running 7.14.2

There are some changes to that in 7.15 beta:
viewtopic.php?t=205246

What's new in 7.15beta4 (2024-Mar-04 08:04):
*) dns - added VRF support (CLI only);

but at the moment I have not seen any related docs/tutorials/explanation on how to use this new feature.

It seems also that there is a bug introduced in 7.14.x that has been fixed in the 7.15 beta:

What's new in 7.15beta6 (2024-Mar-08 08:23):
*) vrf - fixed VRF interfaces being moved to main table after reboot (introduced in v7.14);