Hello,
I have an issue with using pubic DNS using hAP ac3 and RouterOS 7.11.2.
I can not resolve nothing using public DNS like 8.8.8.8 or 8.8.4.4.
From client I have:
~$ nslookup google.com 8.8.8.8
;; communications error to 8.8.8.8#53: timed out
;; communications error to 8.8.8.8#53: timed out
;; communications error to 8.8.8.8#53: timed out
;; no servers could be reached
And from Mikrotik:
@MikroTik] > put [resolve google.com server 8.8.8.8]
failure: dns server failure
I don't any rule in firewall to redirect the DNS trafic and also on specific NAT.
I can ping DNS server:
~$ nslookup google.com 8.8.8.8
;; communications error to 8.8.8.8#53: timed out
;; communications error to 8.8.8.8#53: timed out
;; communications error to 8.8.8.8#53: timed out
;; no servers could be reached
And also port 53 is open:
~$ telnet 8.8.8.8 53
Trying 8.8.8.8...
Connected to 8.8.8.8.
Escape character is '^]'.
Connection closed by foreign host.
Do you have any advice on this issue, please?
Thank you!
Re: RouterOS 7.11.2 - "dns server failure" using public DNS
Yeah,
/export file=anynameyouwish (minus router serial number and any public WANIP information).
Its all opinion until we see facts!
/export file=anynameyouwish (minus router serial number and any public WANIP information).
Its all opinion until we see facts!
Re: RouterOS 7.11.2 - "dns server failure" using public DNS
Hello,
the configuration of my router bellow:
the configuration of my router bellow:
Code: Select all
# 2023-10-25 08:40:18 by RouterOS 7.11.2
# software id = ****
#
# model = RBD53iG-5HacD2HnD
/caps-man channel
add band=2ghz-b/g/n name=2,4ghz
/interface bridge
add admin-mac=******* auto-mac=no comment=defconf name=LAN
/interface wireless
# managed by CAPsMAN
# channel: 2437/20-eC/gn(17dBm), SSID: ******, CAPsMAN forwarding
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=\
MikroTik-**** wireless-protocol=802.11
# managed by CAPsMAN
# channel: 5320/20-eeeC/ac/DP(14dBm), SSID: *******, CAPsMAN forwarding
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX distance=indoors frequency=auto installation=indoor \
mode=ap-bridge ssid=MikroTik-**** wireless-protocol=802.11
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 keepalive-timeout=\
disabled name=pppoe-out1 use-peer-dns=yes user=********
/caps-man datapath
add bridge=LAN client-to-client-forwarding=no local-forwarding=no name=\
datapath1
/caps-man configuration
add country=romania datapath=datapath1 distance=indoors installation=indoor \
mode=ap name=*****_cfg security.authentication-types=wpa2-psk \
.encryption=aes-ccm ssid=******
add channel=2,4ghz country=romania datapath=datapath1 distance=indoors \
installation=indoor name=******_cfg security.authentication-types=\
wpa2-psk .encryption=aes-ccm ssid=********
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN_NEW
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=LAN ranges=192.168.2.110-192.168.2.210
/ip dhcp-server
add address-pool=LAN interface=LAN lease-time=10m name=DHCPonLAN
/system logging action
add name=failedauth target=memory
/caps-man manager
set enabled=yes package-path=/ upgrade-policy=suggest-same-version
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=******_cfg \
slave-configurations=********_cfg
/interface bridge port
add bridge=LAN comment=defconf interface=ether2
add bridge=LAN comment=defconf interface=ether3
add bridge=LAN comment=defconf interface=ether4
add bridge=LAN comment=defconf interface=ether5
add bridge=LAN comment=defconf interface=wlan1
add bridge=LAN comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN_NEW
/interface list member
add comment=defconf interface=LAN list=LAN_NEW
add comment=defconf interface=ether1 list=WAN
add interface=ether2 list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=pppoe-out1 list=discover
add interface=LAN list=discover
add interface=ether2 list=mac-winbox
/interface wireless cap
#
set caps-man-addresses=127.0.0.1 enabled=yes interfaces=wlan1,wlan2
/ip address
add address=192.168.88.1/24 comment=defconf interface=LAN network=\
192.168.88.0
add address=192.168.2.1/24 comment=defconf interface=LAN network=192.168.2.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.2.141 comment=LGwebOSTV_WiFi mac-address=\
******** server=DHCPonLAN
/ip dhcp-server network
add address=192.168.2.0/24 comment=defconf gateway=192.168.2.1 netmask=24
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=********* list=MyWAnIP
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN_NEW
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=fasttrack-connection chain=forward comment="FastTrack DNS TCP" \
dst-port=53 hw-offload=yes protocol=tcp
add action=fasttrack-connection chain=forward comment="FastTrack DNS UDP" \
dst-port=53 hw-offload=yes protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat comment="Harpin NAT" dst-address=\
192.168.2.0/24 src-address=192.168.2.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface=pppoe-out1
add action=dst-nat chain=dstnat dst-port=37775 in-interface=pppoe-out1 \
protocol=tcp to-addresses=192.168.2.*** to-ports=37775
add action=dst-nat chain=dstnat disabled=yes dst-port=1194 in-interface=\
pppoe-out1 protocol=tcp to-addresses=192.168.2.*** to-ports=1194
add action=dst-nat chain=dstnat disabled=yes dst-port=443 in-interface=\
pppoe-out1 protocol=tcp to-addresses=192.168.2.*** to-ports=443
add action=dst-nat chain=dstnat comment=\
"****** access from: https://*******/" \
dst-address-list=MyWAnIP dst-port=443 protocol=tcp to-addresses=\
192.168.2.*** to-ports=443
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.2.0/24
set ssh address=192.168.2.0/24 port=2200
set api disabled=yes
set winbox address=192.168.2.0/24
set api-ssl disabled=yes
/ip socks
set enabled=yes port=4713
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN_NEW
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN_NEW
/system clock
set time-zone-name=Europe/Bucharest
/system logging
add action=failedauth topics=critical,system,error
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=mactel
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox
Last edited by colcm on Wed Oct 25, 2023 9:21 am, edited 1 time in total.
Re: RouterOS 7.11.2 - "dns server failure" using public DNS
Naming your bridge LAN is very confusing and not recommended.
I do not understand why you have two subnet addresses assigned to the bridge....???
I do not understand why you have two subnet addresses assigned to the bridge....???
Re: RouterOS 7.11.2 - "dns server failure" using public DNS
Hello,
the address 192.168.88.0 was default one. I have delete it but the issue with DNS is the same.
Thank you!
the address 192.168.88.0 was default one. I have delete it but the issue with DNS is the same.
Thank you!
Re: RouterOS 7.11.2 - "dns server failure" using public DNS
Delete the static setting add at least one server to IP DNS
From:
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
TO:
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
From:
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
TO:
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
Re: RouterOS 7.11.2 - "dns server failure" using public DNS
Hello,
I have changed the configuration like you propose (delete also static address):
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
I have tried from Mikrotik:
@MikroTik] > put [resolve google.com server 1.1.1.1]
failure: dns server failure
@MikroTik] > put [resolve google.com server 8.8.8.8]
failure: dns server failure
If I not specify the DNS server is it OK:
@MikroTik] > put [resolve google.com]
142.250.180.206
From client is the same:
nslookup google.com 1.1.1.1
;; communications error to 1.1.1.1#53: timed out
;; communications error to 1.1.1.1#53: timed out
;; communications error to 1.1.1.1#53: timed out
;; no servers could be reached
Thank you!
I have changed the configuration like you propose (delete also static address):
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
I have tried from Mikrotik:
@MikroTik] > put [resolve google.com server 1.1.1.1]
failure: dns server failure
@MikroTik] > put [resolve google.com server 8.8.8.8]
failure: dns server failure
If I not specify the DNS server is it OK:
@MikroTik] > put [resolve google.com]
142.250.180.206
From client is the same:
nslookup google.com 1.1.1.1
;; communications error to 1.1.1.1#53: timed out
;; communications error to 1.1.1.1#53: timed out
;; communications error to 1.1.1.1#53: timed out
;; no servers could be reached
Thank you!
Re: RouterOS 7.11.2 - "dns server failure" using public DNS
Not sure what these are for as never seen them on any config ??? Recommend removing!!
add action=fasttrack-connection chain=forward comment="FastTrack DNS TCP" \
dst-port=53 hw-offload=yes protocol=tcp
add action=fasttrack-connection chain=forward comment="FastTrack DNS UDP" \
dst-port=53 hw-offload=yes protocol=udp
Other than that nothing much else I can pick out. The www service is not a secure method for accessing the router and should be disabled.
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.2.0/24
set ssh address=192.168.2.0/24 port=2200
set api disabled=yes
set winbox address=192.168.2.0/24
set api-ssl disabled=yes
add action=fasttrack-connection chain=forward comment="FastTrack DNS TCP" \
dst-port=53 hw-offload=yes protocol=tcp
add action=fasttrack-connection chain=forward comment="FastTrack DNS UDP" \
dst-port=53 hw-offload=yes protocol=udp
Other than that nothing much else I can pick out. The www service is not a secure method for accessing the router and should be disabled.
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.2.0/24
set ssh address=192.168.2.0/24 port=2200
set api disabled=yes
set winbox address=192.168.2.0/24
set api-ssl disabled=yes
Re: RouterOS 7.11.2 - "dns server failure" using public DNS
Hello,
finally the issue was on ISP side. They solve the issue and now is working.
Thank you!
finally the issue was on ISP side. They solve the issue and now is working.
Thank you!
Re: RouterOS 7.11.2 - "dns server failure" using public DNS
For Me - I am the ISP...
Turns out was agressive Firewall.
Blocked input for UDP on all ppp interfaces, so looks like I did not have an "established/related" rule above... Was not trying from inside the network - was just testing from the router itself.
Our Router does not need UDP input generally except for DNS - so just moved it below our std block external DNS and allow local (and also the established rule)... Not sure why this site has a block on UDP, but meh.
Router is going to be DNS proxy though, so would have been a disaster had I not noticed (old Windows DHCP getting retired today)
Clients would have been shot had I not noticed, as it is a proxy, inless they had assigned DNS.
Noticed as time was 1 month out - so NTP had failed - so just lucky I guess.
Turns out was agressive Firewall.
Blocked input for UDP on all ppp interfaces, so looks like I did not have an "established/related" rule above... Was not trying from inside the network - was just testing from the router itself.
Our Router does not need UDP input generally except for DNS - so just moved it below our std block external DNS and allow local (and also the established rule)... Not sure why this site has a block on UDP, but meh.
Router is going to be DNS proxy though, so would have been a disaster had I not noticed (old Windows DHCP getting retired today)
Clients would have been shot had I not noticed, as it is a proxy, inless they had assigned DNS.
Noticed as time was 1 month out - so NTP had failed - so just lucky I guess.
Who is online
Users browsing this forum: Callahan and 10 guests