I think I’m missing the obvious, but this one is throwing me for a loop.
Current configuration (simplified for troubleshooting) is below. Clients on 192.168.8.0/24 subnet can query external DNS servers, including 8.8.8.8. RB is configured with DNS set to 8.8.8.8. However, RB can not seem to successfully query external DNS.
Am I missing an obvious firewall issue?
All IPs/passwords/etc have been sanitized.
# by RouterOS 6.30.4
# software id =
#
/interface bridge
add admin-mac=FF:EE:DD:CC:BB:AA auto-mac=no name=bridge-local
/interface ovpn-client
add cipher=aes256 connect-to=42.22.44.55 disabled=yes mac-address=\
FF:FF:FF:FF:FF:FF name=ovpn-out-O+E password=notthepass \
user=oVPN-WH
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
country="united states" disabled=no distance=indoors frequency=auto \
l2mtu=1600 mode=ap-bridge ssid=XXX wireless-protocol=802.11
/ip neighbor discovery
set ether1-gateway discover=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik wpa-pre-shared-key=XXXXXX \
wpa2-pre-shared-key=XXXXXX
add authentication-types=wpa-psk,wpa2-psk management-protection=allowed mode=\
dynamic-keys name=profile1 supplicant-identity=MikroTik \
wpa-pre-shared-key=XXXXX wpa2-pre-shared-key=XXXXX
add management-protection=allowed name=Guest supplicant-identity=MikroTik
/interface wireless
add disabled=no l2mtu=1600 mac-address=FF:FF:FF:FF:FF:FD master-interface=\
wlan1 name=Guest security-profile=Guest ssid=XXXX_guest wds-cost-range=\
0-4294967295 wds-default-cost=0
/ip pool
add name=dhcp ranges=192.168.8.10-192.168.8.254
add name=dhcp_pool1 ranges=192.168.11.2-192.168.11.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge-local name=default
add address-pool=dhcp_pool1 disabled=no interface=Guest lease-time=1h name=\
dhcp1
/queue simple
add max-limit=2M/20M name=queue1 target=192.168.11.0/24
/interface bridge port
add bridge=bridge-local interface=ether2-master-local
add bridge=bridge-local interface=ether6-master-local
add bridge=bridge-local interface=sfp1
add bridge=bridge-local interface=wlan1
/ip address
add address=192.168.8.1/24 comment="default configuration" interface=\
ether2-master-local network=192.168.8.0
add address=12.34.56.19/24 comment="ISP static" interface=\
ether1-gateway network=12.34.56.0
add address=192.168.11.1/24 interface=Guest network=192.168.11.0
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid interface=\
ether1-gateway
/ip dhcp-server network
add address=192.168.11.0/24 gateway=192.168.11.1
add address=192.168.8.0/24 comment="default configuration" gateway=\
192.168.8.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.8.1 name=router
/ip firewall filter
add action=fasttrack-connection chain=forward comment="default configuration" \
connection-state=established,related
add action=drop chain=forward dst-address=192.168.0.0/16 src-address=\
192.168.11.0/24
add chain=forward comment="default configuration" connection-state=\
established,related
add action=drop chain=forward comment="default configuration" \
connection-state=invalid
add action=drop chain=forward comment="default configuration" \
connection-nat-state=!dstnat connection-state=new in-interface=\
ether1-gateway
add chain=input comment="allow router mgmt. from single IP." src-address=\
55.55.55.80/29
add chain=input comment="default configuration" protocol=icmp
add chain=input in-interface=bridge-local src-address=!192.168.11.0/24
add chain=input dst-port=53 protocol=tcp
add chain=input dst-port=53 protocol=udp
add action=drop chain=input comment="default configuration" in-interface=\
ether1-gateway
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
out-interface=ether1-gateway
/ip route
add distance=1 gateway=12.34.56.1