drop all dns request from Internet to my network

RouterOS General
1

hello all

my network 82.15.xx.0/24

i have need drop all DNS request from Internet to my network !


that’s mean :

Internet ( udp 53 Request ) -----> 82.15.xx.0/24 —Drop
82.15.xx.0/24 -----> Internet ( udp 53 Request ) —Allow


thanks

2

You have to drop all unwanted incoming packets from Internet generally.

3

how to detect unwanted incoming packets in firewall ?
are you means : connections state ?

4

drop input chain with dst port 53 protocol udp on outside interface.

and the generic approach drop input chain in outside interface not established.

5

for raw table;

/ip firewall raw
add action=drop chain=prerouting dst-port=53 in-interface=WAN protocol=tcp
add action=drop chain=prerouting dst-port=53 in-interface=WAN protocol=udp

for filter;

/ip firewall filter
add action=reject chain=input comment=DNS dst-port=53 protocol=udp reject-with=icmp-port-unreachable
add action=reject chain=input comment=DNS dst-port=53 protocol=tcp reject-with=icmp-port-unreachable

Or

/ip firewall filter
add action=drop chain=input comment=DNS dst-port=53 protocol=udp
add action=drop chain=input comment=DNS dst-port=53 protocol=tcp
add action=drop chain=foward comment=DNS dst-port=53 protocol=udp
add action=drop chain=foward comment=DNS dst-port=53 protocol=tcp
6

Dropping port 53 is really insufficient. Get inspiration from documentation:
https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter#Basic_examples