packet filter by content

RouterOS General
1

I see in documentation that one can include content=xxxx
I know this can be done with “layer7” but for simplicity I’m trying to match using content=xxx.

My scenario is this: I need to redirect DNS queries for the domain name “aaa.b-c.d” to a specific DNS server. So I added

/ip firewall nat add action=dst-nat chain=dstnat content=aaa.b-c.d dst-port=53 protocol=udp src-address=10.1.1.200 to-addresses=10.1.2.100

then from 10.1.1.200 I try dig aaa.b-c.d to query the dns but the packet is not matched (counters counts 0 packets).

I tried this way:

/ip firewall nat add action=dst-nat chain=dstnat content=aaa dst-port=53 protocol=udp src-address=10.1.1.200 to-addresses=10.1.2.100

And when I do dig “dig aaa.b-c.d”, the packets are matched. I also tried to match content=b-c and it also worked as expected.

It looks like the dot in the string is causing the problem. I tried adding backslash () in front of the dots and it didn’t work also.
Anyone has an idea on what can be happening here=

2

This should be handled on DNS server side with forwarding, not firewall, if 10.1.1.200 is ROS DNS server then by adding forward static record (help page), eg.:
if you want to forward for any host on .b-c.d domain (*.b-c.d):

/ip/dns/static add forward-to=10.1.2.100 regexp=".*\\.b-c\\.d" type=FWD

if you want to forward exact host on domain (only for aaa.b-c.d):

/ip/dns/static add forward-to=10.1.2.100 name="aaa.b-c.d" type=FWD

If is not ROS DNS server then check for such server how to setup forwarding there (it should support it).

3

Interesting tip but in my case users must use a corporative DNS server, not mikrotik’s one.

But even if they could, my question is why the filters can’t match a string that contains dots and how to solve it. In this case what I want to do is to match DNS packets but it could be any other protocol.

4

I would suggest to look at the packets sniffer before trying to match anything.
If you look at DNS query you will see that what you think is a dot is not a dot. Separator is non-printable character and cannot be matched with “content” parameter.

5

This more looks like to be DNS hijacking

6

:sunglasses:

7

ohhhh you are right!

It sends character 10 (0A) instead of the dots!

so… I should check if it’s possible to include this character in the string…

8

Yes, but in this case it’s an internal problem of the company. I must redirect some queries to a VPN, but the IP is not always the same. I must redirect the DNS queries first but I don’t know to redirect all DNS queries. Only for this domain name.

9

Try with hairpin DNS port to ROS DNS and set static forward rules there as explained in above post. In such case you will have additional DNS in the middle.