hAP Lite: Blocking DNS query from wifi repeater

RouterOS Beginner Basics
1

Hi
I am having an issue with a wifi repeater connected to my hAP Lite. It insists on making itself one of the DNS servers to any clients attached. It appears that it has built in DNS servers of 8.8.8.8 (Google) and 114.114.114.114 (China). Though I have switched it to router/AP mode and tried changing DNS server settings, this seems to make no difference when using repeater mode - it always defaults to setting itself as a DNS server (not DHCP). Is there a way I can block both the Google and Chinese DNS servers from being used on these clients and force them to use the ones I have set on the hAP lite instead? I am a relative newbie to MikroTik and find the interface complicated… :slight_smile:.
Thanks!

2

You can catch DNS queries and redirect them to your router, basic rules are:

/ip firewall nat
add action=redirect chain=dstnat dst-port=53 protocol=tcp
add action=redirect chain=dstnat dst-port=53 protocol=udp

You’ll probably want to add some futher conditions like src-address= (if it just works as DNS resolver for clients) or in-interface= (if clients themeselves use wrong addresses). You can also redirect only queries to selected server with dst-address=.

3

Thank you - this helped me understand how to go about it. Interestingly enough, when I use these settings to block the DNS requests, no data seems to come back; for example, the browser performs a DNS request which appears successful, and then waits until time out. The DNS settings on the connection to the extender are Primary: Extender IP address; Secondary: DNS server provided by router. It appears that the secondary server is not used at all…

4

So I used this and it seems to have done the trick:

add chain=dstnat action=dst-nat to-addresses=my.dns.server.ip to-ports=53 protocol=tcp dst-port=53
add chain=dstnat action=dst-nat to-addresses=my.dns.server.ip to-ports=53 protocol=udp dst-port=53