DNS conditional forward, partly successful

RouterOS Scripting
1

Hi everybody,

I found an excellent guide at dalemacartney.com with instruction on how to forward a DNS request to specific DNS server based on the domain name. This works great for DNS requests from clients on LAN side, but I need it for scripting purposes and the rules are bypassed when doing :resolve from terminal.

I anyone can help me it would be much appreciated. These are the rules from Dale that makes the magic happen :slight_smile:

[admin@RouterOS] > /ip firewall layer7-protocol add name=example.com regexp=example.com
[admin@RouterOS] > /ip firewall mangle add chain=prerouting dst-address=10.0.0.254 layer7-protocol=example.com action=mark-connection new-connection-mark=example.com-forward protocol=tcp dst-port=53
[admin@RouterOS] > /ip firewall mangle add chain=prerouting dst-address=10.0.0.254 layer7-protocol=example.com action=mark-connection new-connection-mark=example.com-forward protocol=udp dst-port=53
[admin@RouterOS] > /ip firewall nat add action=dst-nat chain=dstnat connection-mark=example.com-forward to-addresses=10.0.1.11
[admin@RouterOS] > /ip firewall nat add action=masquerade chain=srcnat connection-mark=example.com-forward

Thank you all in advance.

2

Dude, i’m on same situation; did you solve your issue about this topic ?.

Regards,

Ivan Reyes

3

There’s nothing you can do with current RouterOS. There’s still no native support for per-domain forwarding, and you can’t dst-nat router’s own output.

4

Try this :

/ip firewall layer7-protocol add name=example regexp=example.com
/ip firewall mangle add action=mark-connection chain=prerouting  dst-port=53 protocol=udp layer7-protocol=example new-connection-mark=example.c passthrough=yes 
/ip firewall mangle add action=mark-packet chain=prerouting connection-mark=example.c new-packet-mark=example.p passthrough=no
/ip firewall nat add action=dst-nat chain=dstnat dst-port=53 packet-mark=example.p protocol=udp to-addresses=4.2.2.1 to-ports=53
5

That’s what works for other clients. But when you resolve names on router itself, DNS packet comes through output chain and there’s no prerouting or dstnat there.

6

Yeah, sorry. Looks like I’ve misread what OP needs to exactly redirect the request from the router itself.