its very great feature if the routerOs v 4.x has firewall src add and dst based on IP address and host name like (src add=scs.msg.yahoo.com) and the routerOs resolve the host name to its IP address automatically because some server don’t has static IP
my question to you - when and how often would the DNS name would be resolved? And what if you have thousand firewall rules?
Hello normis
i mean the RouterOs should accept not only ip address in firewall it should be accept the hots name.
for example
instead of dst add=62.13.211.12 the routeros should accept dst add=www.xyz.com
Remember that DNS is just for our convenience. The IP address is the only absolute value of any address so it’s best to pre-resolve the address with scripts.
At least that’s how I see it.
you didn’t understand my question. DNS names should be resolved against a DNS server. When and how often would RouterOS do it? It would take a LOT of resources if you have many rules.
DNS names should be resolved against a DNS server. When and how often would RouterOS do it?
Rely upon the existing DNS Cache and existing Caching function of RouterOS running on the router itself.
Presumably the TTL of the DNS record influences how often re-resolution occurs.
To conserve resources FW Rules could limit access to that DNS Cache if desired to a limited set of ip blocks, or just the router itself. And, you would want to limit the use of such a feature.
Hi,
I would like to resurrect this old thread instead of opening a new feature request
I’m currently using host based firewall rules to route specific sites to a VPN interface instead of routing everything.
the mikrotik wiki has a script to achieve this( a bit of a dirty solution but it works)
https://wiki.mikrotik.com/wiki/Use_host_names_in_firewall_rules
I used another script from here : http://wiki.azotel.com/mikrotik-use-host-names-in-the-firewall
I think it’s better than the wiki script, it uses the dns cache to update the address list and then i use the address list in the mangle to route the traffic through vpn’s route, it can handle websites with multiple IPs well.
I still consider it a dirty solution especially since I have to schedule the script(instead of relying on the DNS record TTL) and the address list will be filled with IP’s
I think that RouterOS firewall should handle host names out of the box without scripts, this will be useful when routing specific sites or blocking sites in kid control.
the solution I have in mind is you just add the host name in the dst address(dst host ?) field of a firewall rule and when the user makes a request the firewall should search dns cache for the requested dst ip and if it matches a dst host filed of a specific firewall rule then act accordingly.
Regards
Wish granted:
/ip firewall address-list
add address=www.mikrotik.com list=mikrotik
add address=forum.mikrotik.com list=mikrotik
/ip firewall filter
add action=accept chain=forward dst-address-list=mikrotik
Do the
/ip firewall address-list
DNS entries update if the registered IPs change?
Yes, it respects TTL and when it times out, it resolves records again.
Thank you!
Wow, Didn’t think that was already implemented, do you know what was the first version of RouterOS to implement this ? also does this handle sites with multiple IPs?
someone should update the wiki page with this simple solution instead of the script and scheduler solution
Regards
Based on what I have quick access to, it is in 6.36.3 but not in 6.34.2, so between that.
Multiple IP addresses for hostname are supported, although this part may not be completely foolproof for some uses. A site could be giving different addresses to different clients, so if your router would use one dns resolver and connected devices would use another, they can possibly get different addresses for same hostname. And if you’d be using such address list e.g. for blocking or allowing access to something, it could fail. So it’s best if all connected devices use router as their dns resolver, to be sure that they have the same data.
There is also quite a low limit on the number of addresses that can be put into a single address list item this way.
(the actual limit depends on the length of the domain name!)
I think this limit is not on the address-list but in the “/ip dns” DNS resolver+cache that is mandatory to use for resolving the DNS name.
Keep that in mind when using this feature e.g. for a blacklist, a whitelist, etc.
That’s over 2 years in ROS. 
search forum: Blocking facebook mikrotik
I think in the release notes that was: dynamic_blacklist
Yes it does handle sites with multiple IPs & IPv6.
Try: tapatalk.com, whatsapp.com
Ok,
After testing, it seems there is one thing missing from this feature which is adding a wildcard hostnames, so instead of adding
the address list should accept wildcards like .example.com and add dynamic rules to anything in the dns cache and check every so often for new entries in the dns cache
It would require to change how it works. Now you give it hostname and router actively resolves it. It’s obvious that it can’t try to resolve all possible combinations. So it would have to be as you suggest, not actively resolve anything, only look for what’s already in cache. But it wouldn’t work for all use cases. For example, I may want to use address list to allow remote access from somewhere and the source will be whatever address some hostname points to. Now it works, but it wouldn’t work if addresses would be only taken from cache, because nothing would be resolving the hostname on router, so it wouldn’t be cached. Perhaps it could stay as it is now for regular hostnames and what you suggest would be used only for wildcards. But people would have to understand how it works and many wouldn’t, so it could be a little confusing.
Yes, I realize it’s a bit hard to implement especially for all use cases, but let’s be honest most use cases that use a hostname would be to block a website or route a specific website though a specific interface, I think your use case is rarely used( most people i saw implement it use ip addresses instead of hostnames)
I don’t think this is confusing at all it will simply have these rules
1- if the rule doesn’t contain wildcard then it will add dynamic addresses to the list with each ip address (A record) (this is the current behavior)
2- if the rules contains a wildcard then it will add dynamic address to the list from the dns cache, now this will add all the records from the cache but what if the user request a new subdomain that is not available in the cache? well, there should be a parameter let’s call it “refresh time” based on this the rule will refresh the address from the cache,so new subdomains will be added
for your use case yes it will not work but the old behavior should still work so you can add your subdomains manually, or you can add your dns records as static dns record, or make a script that resolves your hostnames regularly
Another difference (edit: well, it’s actually the same principle) is that now it’s independent, the address list will have address(es) even when nothing uses router’s DNS resolver (device can have e.g. hardcoded 8.8.8.8). It’s true that it’s not foolproof now either, some sites can have multiple addresses that they give out randomly, so it’s not reliable for them if it’s like this. Sure, it’s possible to solve this by redirecting all DNS queries to router.
So “confusing” may be too strong word, but let’s say a little less predictable, with slightly higher chance to not do what’s expected. But a way to match all subdomains would be useful, that’s true. You have to find a way how to convince MikroTik to come up with something.
Wait a moment! I use it all the time, for many different purposes!
I cannot help that others type literal IP addresses. DNS is so much more convenient.
W.r.t. your other suggestion: you have to understand that this method of setting up an address list is not at all related to actual traffic.
The DNS queries are made (once everytime the TTL runs down to zero) no matter if there is any related traffic, and any traffic only matches what is in the address list, it does not manage the content.
For that, there is a separate firewall rule to add an address to the list when it matches certain criteria.