DDNS broke from Mikrotik 2.9.27 to 3.22

RouterOS General
1

Is anyone using ‘/tool dns-update’ successfully on Mikrotik 3.22?
The exact same command that was working on Mikrotik 2.9.27 is not working anymore after the upgrade to 3.22.
I just upgraded BIND to version 9.6.0-P1, the same error happens.

[admin@home-radio] > /tool dns-update address=1.2.3.4 name=home key-name=home key=“MTIzNDU2Nzg5MDEyMzQ1Ng==” dns-server=x.x.x.x zone=yyy.com.br ttl=5
bad key

The only things changed in the command above were the dns-server and the left part of the zone. All the rest is exactly like I ran it here. On 2.9.27 it works, but on 3.22 I get ‘bad key’.

BIND logs the following on the server side:

Mar 26 11:07:58 hahn named[55861]: client 200.102.59.67#40114: request has invalid signature: TSIG home: tsig verify failure (BADSIG)

Could somebody please confirm whether ‘/tool dns-update’ is working on Mikrotik 3.22? If yes, an example of how you are using it would be very welcome.

Thank you.

2

For sure it’s working but I’ve only been successful with the changeip service. If you’re trying to use dyndns.org or something similar then perhaps it wont work properly.

Who is your account with?

3

hilton, he’s talking about the DDNS which is something else, it’s when you have your own BIND server
http://www.mikrotik.com/testdocs/ros/3.0/system/ddns.php

4

same tool though.

sorry but I’ve haven’t tried BIND yet.

5

I created a free account on changeip.com for testing (andresantos.dns-stuff.com). I’m still looking for how to use it with Mikrotik (f.i. what should dns-server, key-name, key be set to?).
Do you remember if you found this documented on their website? Any pointers would be welcome.
They have a lot of documentation on Windows clients and updating through their website. If you hadn’t told me they supported this functionality I would have thought they didn’t.

6

Look at this article:
http://wiki.mikrotik.com/wiki/Dynamic_DNS_Update_Script_for_ChangeIP.com

7

Thank you mrz. Mikrotik’s ‘/tool dns-update’ worked with changeip. I used the following command:

/tool dns-update name=andresantos.dns-stuff.com address=5.5.5.5 key-name=andresantos key=xxxxxxx

(‘key’ was the only parameter changed)

It’s interesting that the default dns-server seems to be the changeip’s DNS server. At least, after running the above command, I can change the name parameter to anything and it will continue to contact the changeip’s DNS server.

I have upgraded Mikrotik to version 2.9.51 and I can still use ‘/tool dns-update’ against ISC’s BIND. So it’s something that was changed between versions 2 and 3 that broke this for me.

I will stay on version 2 for now. Any ideas are welcome.

Thank you.

8

Forgot to mention: I have also tested Mikrotik 3.13 and 4.0beta2. Same error as 3.22.

9

is your routerOS time within a minute of the BIND server? If you convert both to UTC time they are in sync ?

10

Yes. Both are using NTP.

When I purposefully set the time to 1 hour earlier, the error message logged by BIND is different. It ends in:

… tsig verify failure (BADTIME)

11

good . thanks