Hi All,
I run a network over vpns and I am routing across the vpn multiple networks. I want to keep a central MK (say 10.0.11.254) with static DNS entries for machines across the network, so I am wondering how can each remote router perform a DNS request to this router (10.0.11.254) only when resolving hostnames that end with .local
Would this be done using REGEX?
Thanks!
actually is not possible.
Sure it is. Something like this should do the work. Requests comes in on ‘ether1’ aimed for the router and all requests for *.local will be redirected to 1.1.1.1
/ip firewall layer7-protocol
add name="DNS .local" regexp="\\x05local"
/ip firewall mangle
add chain=prerouting protocol=udp dst-port=53 in-interface=ether1 layer7-protocol="DNS .local" action=mark-packet new-packet-mark="DNS .local" passthrough=no
/ip firewall nat
add chain=dstnat protocol=udp dst-port=53 in-interface=ether1 packet-mark="DNS .local" action=dst-nat to-addresses=1.1.1.1
add chain=srcnat protocol=udp dst-port=53 packet-mark="DNS .local" action=masquerade
OK, some review and some hint.
/ip firewall layer7-protocol
add name="DNS .local" regexp="\\x05local" <-- This also match for example www.localtaxi.com, must be put the next character expected after the end of name inside DNS packet.
/ip firewall mangle
add chain=prerouting protocol=udp dst-port=53 in-interface=ether1 layer7-protocol="DNS .local" action=mark-packet new-packet-mark="DNS .local" passthrough=no
add chain=prerouting protocol=tcp dst-port=53 in-interface=ether1 layer7-protocol="DNS .local" action=mark-packet new-packet-mark="DNS .local" passthrough=no
/ip firewall nat
add chain=dstnat protocol=udp dst-port=53 in-interface=ether1 packet-mark="DNS .local" action=dst-nat to-addresses=1.1.1.1
add chain=dstnat protocol=tcp dst-port=53 in-interface=ether1 packet-mark="DNS .local" action=dst-nat to-addresses=1.1.1.1
add chain=srcnat protocol=udp dst-port=53 packet-mark="DNS .local" action=masquerade <-- Tis is really needed?
add chain=srcnat protocol=tcp dst-port=53 packet-mark="DNS .local" action=masquerade <-- Tis is really needed?
Well you are right that you can false positive matches, but not with something like www.localtaxi.com, only with something like local.com or www.local.com (the \x05 part makes sure of that). I have tried a few ways to enhance it, and this filter even them out:
/ip firewall layer7-protocol
add name="DNS .local" regexp="\\x05local\\x01\\x01"
the L7 regex matcher filter out all \x00, so you can’t match on them, but you can match on what it left
This only work for UDP DNS requests, TCP connections will already have been established before the data packet arrives, so it will be to late to redirect. So no need for TCP matching, on the other hand, if the DNS requests should be TCP based, then there is no way for RouterOS to redirect them, that would require a true DNS forwarder capability (hint hint nudge nudge MikroTik).
The masquerade NAT rule is needed, so replies comes back to the router, so it can be properly NATed back to the client, or they will be sent directly to the client form an unexpected host.
Well done and well explained:
I will admit, I don’t know anything about REGEX expressions.
Could you please tell me how to form the REGEX expression if I wanted a specific domain DNS redirected? Using your example above, it would be domain.com instead of domain.local. What does the /05x mean?
\x05 = length of the following hostname part, that’s how names are encoded in dns packets
domain.com => regexp=“\x06domain\x03com”
domain.info => regexp=“\x06domain\x04info”
test.com => regexp=“\x04test\x03com”
domain.local => regexp=“\x06domain\x05local”
sub.domain.test => regexp=“\x03\x06domain\x04test”
The trailing \x01\x01, to filter out false positives (as suggested by psamsig), looks like a good idea, but the first \x01 is actually query type, so it will match A record queries only. To match all record types, this should work (but I can’t test it now):
domain.com => regexp=“\x06domain\x03com.\x01”