Pi-hole forced DNS redirection with failover script

[zilexa]

@rextended

Hi
Where do you specify the “outgoing public DNS”?

@Doronext

I’m trying to create a Pi-hole DNS failover script, without luck so far.

Currently I have a Pi-hole in my network with IP address 192.168.18.2. The router has an outgoing public DNS of 1.1.1.1 and 1.0.0.1. The DHCP server has DNS 192.168.18.1 (router gateway) for the clients.
I’ve added the following NAT rules to force all DNS through the Pi-hole:

/ip firewall nat

add chain=dstnat action=dst-nat to-addresses=192.168.18.2 protocol=udp src-address=!192.168.18.2 dst-address=!192.168.18.2 dst-port=53 comment="piholeNAT1"
add chain=dstnat action=dst-nat to-addresses=192.168.18.2 protocol=tcp src-address=!192.168.18.2 dst-address=!192.168.18.2 dst-port=53 comment="piholeNAT2"

add chain=srcnat action=masquerade protocol=udp src-address=192.168.18.0/24 dst-address=192.168.18.2 dst-port=53 comment="piholeNAT3"
add chain=srcnat action=masquerade protocol=tcp src-address=192.168.18.0/24 dst-address=192.168.18.2 dst-port=53 comment="piholeNAT4"

What I would like to do in case of failure of the Pi-hole is disabling these NAT rules. When these NAT rules are disabled, the clients DNS will go through the router gateway and public DNS 1.1.1.1/1.0.0.1 like normal until the Pi-hole is up again (NAT rules get enabled again and DNS redirect to Pi-hole).
I’ve created the following script, scheduled at an interval of 30 seconds:

:local piholeDNS "192.168.18.2"
:local testDomain "www.google.com"


:if ([/ip firewall nat [find comment="piholeNAT1"] enabled]) do={
    :do {
        :resolve $testDomain server $piholeDNS
    } on-error={
		/ip firewall nat disable [find comment="piholeNAT1"]
		/ip firewall nat disable [find comment="piholeNAT2"]
		/ip firewall nat disable [find comment="piholeNAT3"]
		/ip firewall nat disable [find comment="piholeNAT4"]
    }
} else={
    :do {
        :resolve $testDomain server $piholeDNS
		/ip firewall nat enable [find comment="piholeNAT1"]
		/ip firewall nat enable [find comment="piholeNAT2"]
		/ip firewall nat enable [find comment="piholeNAT3"]
		/ip firewall nat enable [find comment="piholeNAT4"]
    } on-error={}
}

When I disconnect the Pi-hole as a failure test, the NAT rules don’t get disabled. So something is obviously wrong in the script. Can somebody help me out?

I have this running for 2 years without ever having to look back. Works nicely. Instructions should be more clear for you.
If you have multiple DNS servers (multiple AdGuard Home or PiHole, see this solution: http://forum.mikrotik.com/t/mikrotik-pihole-unbound/148772/20