So how do you point your Windows/Linux/MacOS machine to some non-53 DNS port?..
I was using firewall nat:
add action=dst-nat chain=dstnat disabled=no dst-port=53 log=yes protocol=udp to-addresses=aa.bb.cc.dd to-ports=5353
this forces anyone to use my resolver, even if some user tries to use another different dns server.
This has other implications of redundance and security that is not part of this topic.
Feature Request:
Actually it’s possible to get a total number of active PPPoE sessions via SNMP using this OID:
1.3.6.1.4.1.9.9.150.1.1.1.0
But if we could get this number in a per interface (or PPPoE Server name) basis, should help to detect and troubleshoot issues when using
Mikrotik routers as BRAS/BNG/PPPoE Server.
If a large number of active sessions from a specific interface or servicename drops suddenly, any monitoring application can trigger an alarm for that interface/servicename.
To workaround we can use this:
/interface pppoe-server print count-only where service=service5
BUT it should be a nice feature to add to SNMP
You can have this info from the radius server. (if used)
Please add the ability to enable or disable successful login attempts for specific users, for example an API user, accounting software logging in and out updating information on the router.
Feature request for /tool sniffer. Please make it possible to submit a filter-port range to the sniffer to allow sniffing like this:
/tool sniffer set filter-ip-protocol=udp filter-port=32000-32255
i have run several DNS servers using many port other than 53, the purpose is for internet filtering, users can select filtering level by choosing dns port, check out https://www.thenetpurifier.com/filtering.php
vote +1 for dstnat in output chain
dst-nat not working in output chain, AFAIK
openvpn UDP
Now that ip firewall address-list (and ipv6 firewall address-list) support DNS lookups, add a way to get subnet entries from DNS.
Unfortunately there is no standard DNS record type for subnets. There is the experimental APL record type (RFC3123) which would be exactly what is needed, but it isn’t supported in DNS servers.
Therefore, I suggest to use TXT records.
Do a query for TXT records for the specified name (after or in parallel to the A and AAAA records already queried) and for each TXT record coming back, check if it conforms to valid subnet notation like 11.22.33.0/24 or 11:22:33:44::/64 and if valid, add it as an address list item.
If you have your own authoritative servers, some already have native support for APL (at least BIND and Knot DNS). And any sensible server allows to add unknown record types using generic syntax. If you have hosted DNS and you depend on some admin interface, it’s another story and I guess support there will be very bad. That was the authoritative part. Resolvers should be transparent for unknown types since forever.
So it may sound perhaps a little too optimistic, but I’d say it’s almost there. And a gentle push (like MikroTik adding support in RouterOS) might help to move things forward. Some people could start using it right away and others would have motivation to nag their DNS providers to add support.
It would be very nice to have a feature to hide rows. Column Hide and Show Footer Works is a great job on the look. Screenshot feature must be implementet too.
I googled for it and I cannot find any DNS server that has documented APL support, including Bind. We use bind 9.
However, if it is supported it would be fine to use APL. Probably with TXT there are less obstacles.
It doesn’t seem to be advertised much, but it looks like BIND has it since 2002.
Advantage of using TXT would be instant availability everywhere. Probably even better reliability, at least in short term, because some broken resolvers will surely show up somewhere. But it’s reinventing the wheel. Purists might also argue that we don’t need yet another thing in TXT, there’s enough of them already.
Encrypt nand filesystem, so when some thieve unsolder it, cant read my config.
Run a script when a port is closed by loop protect.
Small feature request:
Please make Syn Cookies tunable!
I explain a bit: right now we can only turn on or off.
I wish we could have cookie timeout tunable in our hands (so if no cookie reply for example in 5 or 10 or 30 sec just drop connection).
That will make defense way easier 
So, you’ll need to enter encryption password each time router reboots?
Please, implement bandstearing for wifi, especially in CAPsMAN.
Please, add support 802.1x for wire interfaces.