Hi All,
Is it recommended to use RB1100 working only as local DNS Server for about 1000 users?
I'm not sure about recommended, as that would depend on the specifics of your particular situation, but you could certainly do it if the routeros DNS software meets your DNS needs.
Hello,
Thank your for your reply, My question is does RB1100 can handle 1000 users DNS request?
To @Kevo's point, it a caching resolver, not a full authoritative DNS & has it's own "unique" schemes. That's why he mention it...
1000 user's DNS request is not that many. If you're talking about a "modern" RB1100AHx*, it should not be any problem. If you're talking about the orginal RB1100 with PowerPC CPU, that should be fine too but never seen one.
While DNS impact for 1000 users for DNS is not too significant. Routing network traffic for 1000 users is WAY different question since that can be a lot of load.
Thank you for reply, We have MikroTik RB1100AHx4
Do we need to touch any default DNS configuration for 1000 users or we can keep default DNS confiuration?
The defaults do not allow client to use the DNS server. So you for sure need: allow-remote-requests=yes
If it's only a DNS server, you can also substantially increase the cache-size, max-concurrent-queries, and max-concurrent-tcp-session.
See defaults here: DNS - RouterOS - MikroTik Documentation
I do run the MikroTik DNS resolver (server) on a network with hundreds of Windows users and I actually experience issues. I have opened [SUP-181093] for it and it is "under investigation". We use a CCR2004.
The problem is not related to performance, but there appears to be some throttling that becomes active way before the max concurrent TCP sessions is reached. There is a warning "possible TCP flooding on port 53" once per boot, but it becomes active later as well, just not logged.
At some point, Windows systems (which are the ones mainly doing TCP queries due to the unfortunate lack of EDNS support in Windows) will be delayed when resolving DNS queries.
I don't have this problem; I get a maximum of 1 or 2 TCP connections per hour.
However, my clients primarily have the CPE acting as a DNS proxy/cache; they don't make direct queries to the two main RB11000s.
As I wrote, it is due to the lack of EDNS in Windows. When your clients make a query that requires EDNS, e.g. a name that returns a large number of IPv4 or IPv6 addresses, it gets a "too large" reply in UDP and re-tries in TCP. It seems that Windows caches that and uses TCP for some time after that.
I solved it by running a bind9 resolver in a VM, solving the issue for the users. I see lots of TCP queries there as well. But of course bind9 does EDNS and the outgoing queries to internet are UDP.
@pe1chl Thank you so much for this information.
I've never had any complaints about it, but I'll check out what you wrote to see how it impacts my clients.
Thanks again.
thank you for sharing experience, We are confused shall we use Mikrotik as a DSN resolver or we should go with external BIND9 server? Kindly advice.
I think you should test it with MikroTik but keep an eye on the performance and compare with another resolver when required...