/IP DNS QUESTION

[nescafe2002]

L7 doesn’t match.

regexp=“\x04local\x05net|\x0288\x03168\x03192\x07in-addr\x04arpa”

should be:

/ip firewall layer7-protocol
add name=local.net regexp="\\x05local\\x03net|\\x0288\\x03168\\x03192\\x07in-addr\\x04arpa"

(note the \x05 before local and \x03 before net)

You could also skip everyhing after \x03net, I just use it to suppress forwarding local reverse name lookups.

/ip firewall layer7-protocol
add name=local.net regexp="\\x05local\\x03net"

Source: http://forum.mikrotik.com/t/redirect-dns-lookup-of-local-domain-to-a-single-dns-server/80611/1

@Sob

\x05 = length of the following hostname part, that’s how names are encoded in dns packets

domain.com => regexp=“\x06domain\x03com”
domain.info => regexp=“\x06domain\x04info”
test.com => regexp=“\x04test\x03com”
domain.local => regexp=“\x06domain\x05local”
sub.domain.test => regexp=“\x03\x06domain\x04test”

The trailing \x01\x01, to filter out false positives (as suggested by psamsig), looks like a good idea, but the first \x01 is actually query type, so it will match A record queries only. To match all record types, this should work (but I can’t test it now):

domain.com => regexp=“\x06domain\x03com.\x01”