I have a setup with 2 subnets. The first subnet is for private use, and the second is a vlan for guests. I want to use opendns for guests only on the vlan. Is there a way to set it up so that I can force everyone on the guest vlan to use opendns servers? I know that if I redirect all dns to the router, and set the router to use opendns servers, it will work, but it will also force my private subnet to use opendns as well, which I do not want. I want to be able to force the guests to use opendns, and, if they try to circumvent it by entering their own dns servers, the router will still use opendns servers. Thanks for any help.
Just set the dns server handed out via dhcp on the guest subnet. You won’t get caching, but that’s a close as you can get since the mikrotik can only one run dns server.
Sent from my SCH-I545 using Tapatalk
You also could use dst nat to force it too.
Sent from my SCH-I545 using Tapatalk
I can use dstnat, but then it applies to my private network too, and defeats the purpose.
I tried to set up dns servers for the guest network, but it doesn’t work. The name servers propagate on the client, but for some reason opendns won’t work. It seems like no matter what the router has as a dns it uses, even though you specify to use something else.
If you thnk dstnat might work, how would you set it up to have 192.168.2.1 always us 208.67.222.222 as it’s DNS servers, and 192.168.1.1 always use the ISP servers?
add chain=dstnat src-address=192.168.2.0/24 protocol=tcp dst-port=53 action=dst-nat to-addresses=208.67.222.222
add chain=dstnat src-address=192.168.2.0/24 protocol=udp dst-port=53 action=dst-nat to-addresses=208.67.222.222Something like this.
Thanks I will give it a try
It worked. I attached a photo of what I did.
- How do I add 2 dns server addresses in the field
- Do I need to add port 53 to the “action” page?
You shouldn’t. That would only be necessary if your “matched” port wasn’t the same as your redirect. E.g. you wanted to direct port 81 to 80 or something.
-Eric
And as for the 2 DNS servers thats more an issue. I’ll have to think how to do it. This is really a hack to get what you want to work. Reason is that RouterOS only allows one instance of a DNS server on it… if you really wanted to do it correctly you would run a different DNS server instance on each network… but without another server or something you can’t do that.
-Eric
Thought about it overnight… here is the solution. It doesn’t support caching locally, but it will do what you want.
/ip filter nat
add chain=dstnat src-address=192.168.2.0/24 dst-address=1.2.3.4 protocol=tcp dst-port=53 action=dst-nat to-addresses=DNS_IP_1
add chain=dstnat src-address=192.168.2.0/24 dst-address=1.2.3.4 protocol=udp dst-port=53 action=dst-nat to-addresses=DNS_IP_1
add chain=dstnat src-address=192.168.2.0/24 protocol=tcp dst-port=53 action=dst-nat to-addresses=DNS_IP_1
add chain=dstnat src-address=192.168.2.0/24 protocol=udp dst-port=53 action=dst-nat to-addresses=DNS_IP_1Then set your clients to use 1.2.3.4 and anything else… When they do a DNS request via 1.2.3.4 they will get DNS_IP_1 instead… if they do it via ANY other IP they will get DNS_IP_2.
Thats as close as you can get without setting up multiple DNS servers.
The other way would be to just use DHCP network settings to assign the dNS_IP_1 and DNS_IP_2 to those clients, but they could always change them and avoid open dns that way. With the DSTNAT as above they can change them to whatever they want and it still won’t avoid opendns.