FEATURE REQUEST: HTTP/2 support into DoH

Are you talking about *) fetch - added HTTP/2 support on ARM64 and x86/CHR devices; in the changelog? Are you sure DoH relies on fetch or is it a guess?

Even Cloudflare DOH isn't working right now. Big Disappointment.

This is due to Cloudflare changing their TLS certificate recently. If you are using the built-in CA in Mikrotik those need to be updated. Or temporairly disable verify-cert in your DNS option.

or import the new cert manually.

/tool fetch https://ssl.com/repo/certs/SSLcomRootCertificationAuthorityECC.pem
/certificate import file-name=SSLcomRootCertificationAuthorityECC.pem passphrase=""
/tool fetch https://ssl.com/repo/certs/SSLcomRootCertificationAuthorityRSA.pem
/certificate import file-name=SSLcomRootCertificationAuthorityRSA.pem passphrase=""

I transferred both manually. I apologize, It escaped my notice.. Thanks for the reminder.

Thank you for this! This was the missing bit for a fully working DoH config on my router.

It would be really great if we could have HTTP/2 support into DoH in future RouterOS releases, this is how I would be able to use DNS4EU service over DoH.

But you could not use DoH because joindns4.eu is only supporting HTTP/2 :wink: and RouterOS do not…

Is there any news if HTTP/2 support for DoH is added to RoS 7.22?
There is one reference to HTTP/2 in the 7.22 threads but it isn’t clear if it also applies to DoH.

It's been a while since I've tested, testing just now quad9 is a NO cloudflare yes BUT using Mozilla due to the cert. Not checked normal. cloudflare.

/ip dns
set use-doh-server=https://mozilla.cloudflare-dns.com/dns-query verify-doh-cert=yes
/ip dns static
add address=1.0.0.1 name=mozilla.cloudflare-dns.com type=A
add address=1.1.1.1 name=mozilla.cloudflare-dns.com type=A
add address=9.9.9.9 disabled=yes name=dns.quad9.net type=A
add address=149.112.112.112 disabled=yes name=dns.quad9.net type=A

Are you sure that in your test it was not HTTP but HTTP/2 used? As Cloudflare supports all the three versions in their DoH…

Or testing HTTP/2 is not the idea of your post? It reads somewhat ambiguously :slight_smile:

But now the support is becoming added, even though only for some device platforms:

* dns - added HTTP/2 support to DoH on ARM64 and x86/CHR devices;

Hope 7.23.x (x=2 or 3) will be available in few weeks in Stable branch.
I would not deploy the initial release of a new version in light of my earlier “adventures”.

Really hope this comes to ARM32 at some point, since ARM64 excludes hEX S and others :frowning:

I wasted a whole morning trying to figure out why DNS4EU DoH works on the hAP ax³ and not on the hAP ax S.

It's a real shame that HTTP/2 is not available for recent arm32 devices. I can understand SMIPS or MIPSBE, but excluding the recent MediaTek ax devices makes no sense.

If it's not possible for arm32, then they should provide the option to install the arm64 version, just like with the L009.

The hAP ax S has a 32-but CPU, not 64-bit. So it cannot run the arm64 version.

The issue about arm32, 16MB flash, and the resulting trouble has been discussed often enough.

Haha, that puts some pressure on Mikrotik. Having 16mb flash arm devices is a big issue when you build packages architecture based. You have to fit the tiniest.

Yes, there should be a separate "RouterOS lite" (or "home") version that has only functionality typical for residential NAT routers. That will then fit 16MB ARM32 devices.

You're right, I hadn't noticed that.

All the new models have 128MB and not 16MB.

As said, it is the same arm32 routeros npk for

  • old arm32 with 16mb flash like cap ac, hap ac2, etc.
  • "new" arm32 like wap ax, hex s 2025, HAP ax s, etc.