DNS accross VLAN's

mishking · February 15, 2026, 2:10pm

Hi,

I am having issues with dns accross vlans. I cannot connect via rdp using hostname, ping a hostname and get a result via nslookup.

This is going from 192.168.1.0/24 to a machine in the SRV vlan which is on 10.16.1.0/24.

If i enable mdns on the bridge and the vlan interfaces it then seems to work but lookups and rdp seem to have a lag before they connect.

I would of expected this to work without enabling mdns?

I have attached the config.

# 2026-02-15 13:53:34 by RouterOS 7.21.3
# software id = QUBT-60A9
#
# model = CCR2004-1G-12S+2XS
# serial number = xx
/interface bridge
add name=BRIDGE priority=0x1024 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=WAN_VM_1GB rx-flow-control=auto \
    tx-flow-control=auto
set [ find default-name=sfp-sfpplus1 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus2 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus3 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus4 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus5 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus6 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus7 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus8 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus9 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus10 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus11 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp-sfpplus12 ] rx-flow-control=auto tx-flow-control=\
    auto
set [ find default-name=sfp28-1 ] rx-flow-control=auto tx-flow-control=auto
set [ find default-name=sfp28-2 ] rx-flow-control=auto tx-flow-control=auto
/interface vlan
add interface=BRIDGE name=MGMT vlan-id=18
add interface=BRIDGE name=SRV vlan-id=16
add interface=BRIDGE name=WIFI vlan-id=200
/interface list
add name=WAN
add name=LAN
/ip pool
add name=LAN ranges=192.168.1.50-192.168.1.250
add name=WIFI ranges=172.16.1.50-172.16.1.250
add name=SRV ranges=10.16.1.50-10.16.1.250
/ip dhcp-server
add address-pool=LAN interface=BRIDGE lease-time=1d name=LAN
add address-pool=WIFI interface=WIFI lease-time=1d name=WIFI
add address-pool=SRV interface=SRV lease-time=1d name=SRV
/ip smb
set enabled=no
/interface bridge port
add bridge=BRIDGE interface=sfp-sfpplus1
add bridge=BRIDGE interface=sfp-sfpplus2
add bridge=BRIDGE interface=sfp-sfpplus3
add bridge=BRIDGE interface=sfp-sfpplus4
add bridge=BRIDGE interface=sfp-sfpplus5
add bridge=BRIDGE interface=sfp-sfpplus6
add bridge=BRIDGE interface=sfp-sfpplus7
add bridge=BRIDGE interface=sfp-sfpplus8
add bridge=BRIDGE interface=sfp-sfpplus9
add bridge=BRIDGE interface=sfp-sfpplus10
add bridge=BRIDGE interface=sfp-sfpplus11
add bridge=BRIDGE interface=sfp-sfpplus12
add bridge=BRIDGE interface=sfp28-1
add bridge=BRIDGE interface=sfp28-2
/ip neighbor discovery-settings
set discover-interface-list=none
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=BRIDGE comment=WIFI tagged=BRIDGE,sfp-sfpplus12 vlan-ids=200
add bridge=BRIDGE comment=SRV tagged=BRIDGE,sfp-sfpplus12 vlan-ids=16
add bridge=BRIDGE comment=MGMT tagged=BRIDGE,sfp-sfpplus12 vlan-ids=18
/interface list member
add interface=WAN_VM_1GB list=WAN
add interface=BRIDGE list=LAN
add interface=WIFI list=LAN
add interface=SRV list=LAN
add interface=MGMT list=LAN
/ip address
add address=192.168.1.1/24 interface=BRIDGE network=192.168.1.0
add address=172.16.1.1/24 interface=WIFI network=172.16.1.0
add address=10.16.1.1/24 interface=SRV network=10.16.1.0
add address=10.18.1.1/24 interface=MGMT network=10.18.1.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add default-route-tables=main interface=WAN_VM_1GB use-peer-dns=no
/ip dhcp-server network
add address=10.16.1.0/24 dns-server=10.16.1.1 gateway=10.16.1.1
add address=172.16.1.0/24 dns-server=172.16.1.1 gateway=172.16.1.1
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes servers=192.168.1.6
/ip dns static
add address=192.168.1.1 name=router.lan type=A
/ip firewall address-list
add address=172.16.1.0/24 list=VLAN
add address=10.16.1.0/24 list=VLAN
add address=192.168.1.0/24 list=LAN
add address=10.18.1.0/24 list=VLAN
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1 \
    in-interface=lo src-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="DROP VLAN TO LAN" dst-address-list=LAN \
    src-address-list=VLAN
add action=drop chain=forward comment="DROP VLAN TO VLAN" dst-address-list=\
    VLAN src-address-list=VLAN
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set winbox address=192.168.1.0/24
set api disabled=yes
set api-ssl disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=WAN_VM_1GB type=external
add interface=BRIDGE type=internal
add interface=WIFI type=internal
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/London
/system health settings
set fan-min-speed-percent=0%
/system identity
set name=CCR2004
/system logging
set 0 topics=info,!dhcp
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool mac-server ping
set enabled=no

mishking · February 16, 2026, 7:15pm

So i think i have my answer.

I had assumed that DHCP would be registering an enrty into the DNS server. Clearly thats not the case.

If i create a static entry for a machine in another vlan all is well and i can RDP,ping nslookup by hostname etc..

Faceplate5158 · February 16, 2026, 9:07pm

In case you haven’t yet found, there are plenty of routeros scripts floating around which will add static DNS entries for DHCP leases. E.g.:

github.com/elevendroids/mikrotik-scripts

dhcp2dns.rsc

master

###
# Script entry point
#
# Expected environment variables - set internally when calling the lease script:
# leaseBound         1 = lease bound, 0 = lease removed
# leaseServerName    Name of DHCP server
# leaseActIP         IP address of DHCP client
# leaseActMAC        MAC address of DHCP client
# lease-hostname     Host name provided by the DHCP client
# lease-options      DHCP options provided by the client
###
:local leaseHostName $"lease-hostname"
:local leaseOptions $"lease-options"
# DNS TTL to set for DNS entries
:local dnsttl "00:15:00"

### Utility functions ###

# Generates a host name from an IP address, ie:
# "192.168.1.10" -> "192-168-1-10"

This file has been truncated. show original

You can add this to the DHCP server script entry:

mishking · February 17, 2026, 7:48pm

Thanks for sharing that script as this ultimately led me to discover what i had done wrong.

I hadn’t populated the domain field for each network under IP –> DHCP Server –> Networks

After adding a search domain, it all now works as it should do.