Hi Mikrotik Team,
Is there any option for IPv6 DNS cache option, I have using IPv6 as DHCPv6 and PPPoE for my clients.
Please suggest me for IPv6 DNS cache setup.
Hi All,
Is there any suggestion for this issue.
I have IPv6 and IPv4 DHCP traffic and PPPoE traffic but In DNS cache nothing is coming.
I can’t say that I’m sure what you’re asking about, but if you want to use DHCPv6 server in RouterOS to give clients addresses of DNS resolvers, it’s possible with manually created option:
http://forum.mikrotik.com/t/ipv6-advertise-router-as-dns/118071/2
If it’s not what you want, try to explain it better.
Hi,
I have asking about DNS cache in IPv6.
I have using Ipv6 as DHCP for my office but DNS cache is not coming.
DHCPv6 in RouterOS currently gives out addresses of DNS servers from IP->DNS, i.e. clients receive those two you have there and they ask them directly, they don’t use cache on router. If you want that, you need to manually create required option (see the link I posted) and put router’s address there.
Actually i have used Hotspot in anther mikrotik there DNS cache works fine. For this i have not created any manual rules i just given script and schedules.
Is there no option on IPv6?
Where did hotspot suddenly come from and how it’s related? I won’t tell you much about that.
But DNS cache works, only there must be something trying to use it. Also, I missed that before, you need to have Allow Remote Requests enabled, but make sure (using firewall) that you allow only your networks to use it, not the whole world.
I have no idea on IPv6 firewall rules can you please share me on this.
Check default config
/system default-configuration print
and scroll down until you get to /ipv6 firewall section
[admin@E4:8D:8C:2B:96:B7] > system default-configuration print
script: #| LAN:
#| IP on ether1: 192.168.88.1/24;
:global defconfMode;
:log info "Starting defconf script";
#-------------------------------------------------------------------------------
Apply configuration.
these commands are executed after installation or configuration reset
#-------------------------------------------------------------------------------
:if ($action = "apply") do={
wait for interfaces
:local count 0;
:while ([/interface ethernet find] = "") do={
:if ($count = 30) do={
:log warning "DefConf: Unable to find ethernet interfaces";
/quit;
}
:delay 1s; :set count ($count +1);
};
/ip address add address=192.168.88.1/24 interface=ether1 comment="defconf";
}
#-------------------------------------------------------------------------------
Revert configuration.
these commands are executed if user requests to remove default configuration
#-------------------------------------------------------------------------------
:if ($action = "revert") do={
/user set admin password=""
/system routerboard mode-button set enabled=no
/system routerboard mode-button set on-event=""
/system script remove [find comment~"defconf"]
/ip firewall filter remove [find comment~"defconf"]
/ipv6 firewall filter remove [find comment~"defconf"]
/ipv6 firewall address-list remove [find comment~"defconf"]
/ip firewall nat remove [find comment~"defconf"]
/interface list member remove [find comment~"defconf"]
/interface detect-internet set detect-interface-list=none
/interface detect-internet set lan-interface-list=none
/interface detect-internet set wan-interface-list=none
/interface detect-internet set internet-interface-list=none
/interface list remove [find comment~"defconf"]
/tool mac-server set allowed-interface-list=all
/tool mac-server mac-winbox set allowed-interface-list=all
/ip neighbor discovery-settings set discover-interface-list=!dynamic
:local o [/ip dhcp-server network find comment="defconf"]
:if ([:len $o] != 0) do={ /ip dhcp-server network remove $o }
:local o [/ip dhcp-server find name="defconf" !disabled]
:if ([:len $o] != 0) do={ /ip dhcp-server remove $o }
/ip pool {
:local o [find name="default-dhcp" ranges=192.168.88.10-192.168.88.254]
:if ([:len $o] != 0) do={ remove $o }
}
:local o [/ip dhcp-client find comment="defconf"]
:if ([:len $o] != 0) do={ /ip dhcp-client remove $o }
/ip dns {
set allow-remote-requests=no
:local o [static find comment="defconf"]
:if ([:len $o] != 0) do={ static remove $o }
}
/ip address {
:local o [find comment="defconf"]
:if ([:len $o] != 0) do={ remove $o }
}
:foreach iface in=[/interface ethernet find] do={
/interface ethernet set $iface name=[get $iface default-name]
}
/interface bridge port remove [find comment="defconf"]
/interface bridge remove [find comment="defconf"]
/interface wireless cap set enabled=no interfaces="" caps-man-addresses=""
/caps-man manager set enabled=no
/caps-man manager interface remove [find comment="defconf"]
/caps-man manager interface set [ find default=yes ] forbid=no
/caps-man provisioning remove [find comment="defconf"]
/caps-man configuration remove [find comment="defconf"]
}
:log info Defconf_script_finished;
:set defconfMode;
caps-mode-script: #-------------------------------------------------------------------------------
Note: script will not execute at all (will throw a syntax error) if
dhcp or wireless-fp packages are not installed
#-------------------------------------------------------------------------------
#| CAP configuration
#|
#| Wireless interfaces are set to be managed by CAPsMAN.
#| All ethernet interfaces and CAPsMAN managed interfaces are bridged.
#| DHCP client is set on bridge interface.
bridge port name
:global brName "bridgeLocal";
:global logPref "defconf:";
:global action;
:log info $action
:if ($action = "apply") do={
wait for ethernet interfaces
:local count 0;
:while ([/interface ethernet find] = "") do={
:if ($count = 30) do={
:log warning "DefConf: Unable to find ethernet interfaces";
/quit;
}
:delay 1s; :set count ($count + 1);
}
:local macSet 0;
:local tmpMac "";
:foreach k in=[/interface ethernet find] do={
first ethernet is found; add bridge and set mac address of the ethernet port
:if ($macSet = 0) do={
:set tmpMac [/interface ethernet get $k mac-address];
/interface bridge add name=$brName auto-mac=no admin-mac=$tmpMac comment="defconf";
:set macSet 1;
}
add bridge ports
/interface bridge port add bridge=$brName interface=$k comment="defconf"
}
try to add dhcp client on bridge interface (may fail if already exist)
:do {
/ip dhcp-client add interface=$brName disabled=no comment="defconf"
} on-error={ :log warning "$logPref unable to add dhcp client";}
\
try to configure caps (may fail if for example specified interfaces are missing)
:local interfacesList "";
:local bFirst 1;
wait for wireless interfaces
:while ([/interface wireless find] = "") do={
:if ($count = 30) do={
:log warning "DefConf: Unable to find wireless interfaces";
/quit;
}
:delay 1s; :set count ($count + 1);
}
delay just to make sure that all wireless interfaces are loaded
:delay 5s;
:foreach i in=[/interface wireless find] do={
if ($bFirst = 1) do={
:set interfacesList [/interface wireless get $i name];
:set bFirst 0;
} else={
:set interfacesList "$interfacesList,$[/interface wireless get $i name]";
}
}
:do {
/interface wireless cap
set enabled=yes interfaces=$interfacesList discovery-interfaces=$brName bridge=$brName
} on-error={ :log warning "$logPref unable to configure caps";}
}
:if ($action = "revert") do={
:do {
/interface wireless cap
set enabled=no interfaces="" discovery-interfaces="" bridge=none
} on-error={ :log warning "$logPref unable to unset caps";}
:local o [/ip dhcp-client find comment="defconf"]
:if ([:len $o] != 0) do={ /ip dhcp-client remove $o }
/interface bridge port remove [find comment="defconf"]
/interface bridge remove [find comment="defconf"]
}
custom-script:
Do you have ipv6 package installed and enabled? Which device type? It’s been mentioned that pro-line (CCE and high-end of RB line) doesn’t come with firewall configured.
I have enabled IPv6 and configured IP
I have CCR1036.
OK, so you’ve got a CCR and those don’t have any notable default config.
Here’s default IPv6 firewall config from my hAP ac2:
/ipv6 firewall {
address-list add list=bad_ipv6 address=::/128 comment="defconf: unspecified address"
address-list add list=bad_ipv6 address=::1 comment="defconf: lo"
address-list add list=bad_ipv6 address=fec0::/10 comment="defconf: site-local"
address-list add list=bad_ipv6 address=::ffff:0:0/96 comment="defconf: ipv4-mapped"
address-list add list=bad_ipv6 address=::/96 comment="defconf: ipv4 compat"
address-list add list=bad_ipv6 address=100::/64 comment="defconf: discard only "
address-list add list=bad_ipv6 address=2001:db8::/32 comment="defconf: documentation"
address-list add list=bad_ipv6 address=2001:10::/28 comment="defconf: ORCHID"
address-list add list=bad_ipv6 address=3ffe::/16 comment="defconf: 6bone"
address-list add list=bad_ipv6 address=::224.0.0.0/100 comment="defconf: other"
address-list add list=bad_ipv6 address=::127.0.0.0/104 comment="defconf: other"
address-list add list=bad_ipv6 address=::/104 comment="defconf: other"
address-list add list=bad_ipv6 address=::255.0.0.0/104 comment="defconf: other"
filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
filter add chain=input action=accept protocol=icmpv6 comment="defconf: accept ICMPv6"
filter add chain=input action=accept protocol=udp port=33434-33534 comment="defconf: accept UDP traceroute"
filter add chain=input action=accept protocol=udp dst-port=546 src-address=fe80::/10 comment="defconf: accept DHCPv6-Client prefix delegation."
filter add chain=input action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE"
filter add chain=input action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH"
filter add chain=input action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP"
filter add chain=input action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy"
filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
filter add chain=forward action=drop src-address-list=bad_ipv6 comment="defconf: drop packets with bad src ipv6"
filter add chain=forward action=drop dst-address-list=bad_ipv6 comment="defconf: drop packets with bad dst ipv6"
filter add chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 comment="defconf: rfc4890 drop hop-limit=1"
filter add chain=forward action=accept protocol=icmpv6 comment="defconf: accept ICMPv6"
filter add chain=forward action=accept protocol=139 comment="defconf: accept HIP"
filter add chain=forward action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE"
filter add chain=forward action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH"
filter add chain=forward action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP"
filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy"
filter add chain=forward action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
}
Note that firewall relies on interface list LAN, which should include all interfaces which are “trusted”.
Is this work with my CCR1036 ?
I don’t see why these rules shouldn’t work on a CCR … they are L3 (apart from dependency on interface list).
When i add this i have got issue with some packets are blocking on mikrotik and when i did trace to any site my mikrotik IP getting request timedout.
In Reply #4 you show DNS settings but you have not enabled “Allow remote requests”.
This means your DNS server is only used by the router itself. Is that what you want?
When you want to use it from other computers, you need to enable “Allow remote requests” AND you need to make sure it is not accessible from internet!
(i.e. make sure your firewall does not pass incoming DNS requests)
The last filter rule effectively blocks all connections which don’t originate from LAN interfaces … so did you add LAN interfaces of your CCR to the mentioned interface list?
If yes, then check filter rules statistics to see which rule blocks the connectivity.
I need DNS cache in my CCR but it was not working on IPv6.