DNS trouble

RouterOS General
1

Hi.
I have configure new PPTP connection on my mikrotik and add a new dns server to configuration:
[admin@MikroTik] > ip dns print
servers: 192.168.151.30
dynamic-servers: 217.77.209.2,217.77.208.146
allow-remote-requests: yes
max-udp-packet-size: 4096
query-server-timeout: 2s
query-total-timeout: 10s
max-concurrent-queries: 100
max-concurrent-tcp-sessions: 20
cache-size: 2048KiB
cache-max-ttl: 1w
cache-used: 78KiB

When I ping hosts from DNS 192.168.151.30, i get error:
[admin@MikroTik] > put [:resolve frontend.***.intranet]
failure: dns name does not exist

In a DNS cache table displayed as “Unknown” type with address 0.0.0.0

But, if i run command from mikrotik: put [:resolve frontend.***.intranet server 192.168.151.30]
I get a real IP address, and in my DNS Cache table add normal entry.

What i do wrong?

2

You need conditional DNS forwarding which is not supported natively by MT.

Just do a search on the forum and you will find various other topics (conditional dns forwarding / dns override).

I’d recommend a L7 rule which will allow clients behind the MT to resolve intranet urls. Resolving on MT will not work (dstnot not possible for router initiated connections).

/ip firewall layer7-protocol
add name=intranet regexp="\\x08intranet.\\x01|\\x03151\\x03168\\x03192\\x07in-addr\\x04arpa"
/ip firewall nat
add action=dst-nat chain=dstnat dst-address-type=local dst-port=53 layer7-protocol=intranet protocol=udp to-addresses=192.168.151.30
3

Can’t the internal DNS server be used for recursive resolving of external addresses as well? DNS server on RB has mediocre capabilities and should really be used only for real simple tasks.

4

@mkx, I considered replying ‘deactivate use-peer-dns on WAN interface’ but that would turn the PPTP link into a singe point of failure. Let alone the latency it could introduce.

5

If LAN is “mission critical” that warrants redundant WAN links, then it also deserves decent supporting services (HA DHCP server, HA DNS server, …) and that’s way above what RB can offer. If LAN is of medium priority, then anything can be single point of failure, so use of single DNS server can be acceptable. Specially so as it seems that there’s only one DNS server resolving “intranet” pseudo-TLD and it does seem to be kind of important. So why not using that presumably decent DNS server to resolve all DNS queries? Decent DNS server implementations allow to configure many “forwarders” - upstream resolvers - in case one does not want to run full recursive DNS server.