We deployed routerboards in our regional branches.
All our remote computers belongs to ms active directory domain, domain controllers are located in central office.
Dns servers for remote computers are set to domain controllers, for a proper AD work.
Now, I want to setup routerboard to act as DNS server for remote computers, and forward DNS queries in a smart way:
if NAME ends with my zone to forward queries to my domain controllers, else forward them to local internet provider.
This will improve response speed, and network performance.
Something like bind has:
zone “mydomain.com” {
type forward;
forward only;
forwarders { 22.22.22.22; };
};
PLEASE include it in TODO list for v5, i think it’s not hard to implement it, as you already have forwarders.
Just define “Dns Zones” as entities and linked forwarders to that zone.
I have not tested this, yet, but it should be possible to create a layer7 protocol that digs into the DNS packet and matches the domain. If the domain is matched then just silently redirect the packet to the proper dns server.
I will post again once I find time to craft and test this.
just be sure that packet that come from that other DNS resolver are with correct src address in reply, other way packet will be rejected by host, how initiated the process.
Here is a little run down on how to do this, the only thing left to do is to check what janisk says but im pretty sure this handles it decently enough.
To make sure this works on all networks regardless of hops and directly connected servers and clients, you could run the test for the regex in prerouting and just mark the packet, and then do both source and destination NAT on the packet so that it’s forced back to the router, enabling it to send it back to the client in a format the client expects:
Big thanks to all experts for suggestiong solutions for this task.
I’ll try to apply it, but it is a bit complicated for me, layer7, mangle, prerouting … a lot of rules, a lot of router cpu usage.
I’d like to have it in DNS area of winbox, and with 2 clicks done it.
Anyway, to developers, take it in account,
I suppose dns zone forwarders, masters are a part of DNS standart, if BIND implemented it.
This is definitely not a beta issue (actually not issue at all) and this topic is also quite old, but I reuse it anyway..
Explained method really works (although I would really appreciate more straightforward way to do this), but is it possible (I pretty sure it is, but my regexp-skilz are just not high enough) to forward all requests ending to ‘.local’ with one L7 entry? If I just replace ‘lantest.mindlesstux.com’ with ‘.local’, this filter hits also to addresses like domainlocal.com and http://www.localaddress.com etc.
My target is forward all requests containing domains like a.local & site.dadsgkdslf.local to one spesific dns-server and without need to add own entry for all (those are domains used in our test-lab, so they changes quite often and maintaining those is not on my shoulders, only rule is that they always end to .local)
Any chance of this being implemented in some future release? Cmon devs, it’s not the hardest request at all.
Everyone who holds more than one local dns area will thank you for sure.
Also, this workaround (l7, mangle, dst-nat etc.) stops working time to time.
Seems like it just doesn’t dig out any l7 info from dns packets.
Reboot and everything is back working for some time (3+hr).
Am I the only one facing such a strange behaviour?
Five years since the request for a dns zone forwarder and still not implemented, in a way I understand RB is not an advanced DNS server to rely on, but it’s still a simple add (I guess, what do I know).
Can anyone advise if using this solution will impact the DNS resolution time ?
I also need conditional forwarding of DNS request.
We are using a lot of Mikrotik products for VPN tunnels for branche office usage. And need DNS forwarding to AD DNS domains to authenticate users on terminals/ client computers.
