I didn’t go through every post, but I noticed that at some point normis asked for a use case.
Example 1:
There are companies that have on-prem systems, that are used both from the Internet and from the corp LAN.
Let’s say company has an email server, located on domain “email.company.net”. The server lives inside the company network. People have laptops, mobile phones, etc. All of that connects to hostname “email.company.net”. When accessing that hostname from inside corp LAN, you have to resolve “email.company.net” hostname to some internal IP address. So it can point local users to a local IP. You don’t access a local server via a public IP, from inside a NAT routed network (maybe with some magic you could, but it’s far less dirty to just give out the local IP to the client). So, in your local DNS you add a record (static entry in Mikrotik) for the hostname. The client receives a local IP address of the server, available inside the LAN and problem is solved. Clients only need to use that DNS server (and DHCP gives then the proper one) and that’s it. Everything works from the Internet and also when you’re inside the corp network where the servers actually live.
This approach solves availability of resources from both corp LAN and Internet, where this is needed.
Example two:
Another example are systems that are not at all available from the Internet directly, but only from through a VPN. Many companies employ this. So, the client (or the entire client network) first has to connect to VPN, then access resources. If this VPN is resolved with Mikrotik (many RB devices, even the cheap ones, have nice hardware offloading for IPSEC, so it’s a very good solution for site-to-site VPN) it’s all good. We just use static entries in DNS in ROS and point clients to use DNS from ROS. And everything works. No need for additional DNS server.
And this all works well for IMAP, SMTP etc, because normally everything on the machine uses DNS server as set up on the system. So email clients and custom applications all work. But what about browsers. All is well until a browser decides not to honor system DNS settings. Then, anything in the corp LAN that you try to access through a browser, doesn’t work anymore. Same is you’re accessing through a VPN. Stuff like CRM, webmail - well, most apps today are web apps anyway, used through a browser.
And now it starting to happen, browsers are trying to reinvent how Internet works. Because… DNS, in it’s standard and widely used implementation, is no longer deemed safe enough. Ok, fine. Someone has to lift the standards. Browsers are trying to do it, other apps will probably follow after that. But if Mikrotik doesn’t follow this change, and MT is used to provide DNS queries, then setups like the ones described in above examples will stop working.
Yeah, we can use a separate DNS server that would solve this, of course, and maybe we should. But why not have it in ROS, as an option at least. Network-wise we have (almost) everything you can imagine in ROS - even stuff you wouldn’t expect to have. But none of the more recent DNS stuff. Why ? Why would Mikrotik not provide a solution that solves this issue, like any other network related issue it already solves, in the same box ?
I understand that many proposals exists to solve DNS problem and it’s not yet clear which one is going to be used in future. It’s hard to know what to implement. One way is to implement just the ones that browsers are going for → because those are the ones we’re going to need to have in our network for above setups to continue working. And that’s probably the ones that everyone is going to switch to in the end.
I believe these setups (like the ones mentioned above) are not at all uncommon. Well, maybe people don’t use ROS for DNS in such cases, but you get the point. So, again, yes, we can solve this by installing a compatible DNS inside our network, but… ROS was always able to handle this stuff for us, without the need for additional equipment. Why would we need to change that. Is it too heavy load for a Mikrotik device (TLS handshakes and all that) ? But recent RB-s are not at all slow, I guess this won’t be a problem. Or would it be ? Normis, could you provide any insight regarding this ?
Regards,
David
