Hello.
I have two Mikrotik devices: hap ax3 working as a router and hap ax2 working as a bridge. I have also defined two separate VLANs: VLAN A and VLAN B.
The DNS Server on hap ax3 (on router) works as a DNS server for VLAN A, but I do not know how to setup that DNS server on bridge (hap ax2) will work as a DNS server for VLAN B?
The goal is that VLAN A have one DNS server working on router and VLAN B has another DNS server on bridge.
Could somebody assist me with these task?
Clients get their DNS server settings from the DHCP server of the router. This is set at /ip dhcp-server network.
You are talking about DNS server on the bridge...that needs some additional explanation. Why would a bridge run a DNS server (it can be configured)?
Additionally, if you share a network diagram (containing IP addresses and VLAN's) and the current configs *) we will be able to provide more information.
*)
/export file=anynameyoulike
Remove serial and any other private info, post as Preformmated text by unsing the </> button in the editor.
Each subnet will have different settings in DHCP server configuration. You should look at /ip/dhcp-server/network and set different DNS servers for different subnets. If dns-server property is not defined in this configuration section, then it's populated from router's own DNS configuration under /ip/dns/.
Please draw a network diagram, documenting vlan flow, Identification of ISP connections etc..........
Note that while you can define the IP address of the DNS resolver on each subnet, it is not currently possible to have multiple DNS resolver instances in the same router.
So those different subnets will all point to the same resolver instance, with the same external servers, the same static records, and a shared cache.
When you need different settings for the subnets, that can currently only be done using containers.
AX3 (router) configuration:
##on router AX3
# 2026-01-19 16:12:55 by RouterOS 7.21
#
# model = C53UiG+5HPaxD2HPaxD
/disk
add parent=usb1 partition-number=1 partition-offset=1048576 partition-size=\
123008450560 type=partition
/interface bridge
add name=intMostek vlan-filtering=yes
/interface vlan
add interface=intMostek name=vlAutomatyka vlan-id=180
add interface=intMostek name=vlOgraniczonyDostep vlan-id=170
add interface=intMostek name=vlPelnyDostep vlan-id=160
/interface list
add name=WAN
add name=LAN
/interface wifi channel
add band=2ghz-ax disabled=no frequency=2452 name=wch2-AX-Podstawowy width=\
20/40mhz
add band=2ghz-ax disabled=no frequency=2412 name=wch2-AX-Drugi width=20/40mhz
add band=5ghz-ax disabled=no frequency=\
5500,5520,5540,5560,5580,5660,5680,5700,5720 name=wch5-AX-Podstawowy \
width=20/40/80mhz
add band=5ghz-ax disabled=no frequency=\
5180,5200,5220,5240,5260,5280,5300,5320 name=wch5-AX-Drugi width=\
20/40/80mhz
/interface wifi datapath
add bridge=intMostek disabled=no name=dtpOgraniczonyDostep \
traffic-processing=on-cap vlan-id=170
add bridge=intMostek disabled=no name=dtpPelnyDostep traffic-processing=\
on-cap vlan-id=160
/interface wifi security
add authentication-types=wpa2-psk connect-priority=0/1 disabled=no ft=yes \
ft-over-ds=yes name=secOgraniczonyDostep
add authentication-types=wpa2-psk connect-priority=0/1 disabled=no ft=yes \
ft-over-ds=yes name=secPelnyDostep
/interface wifi steering
add disabled=no name=strWIFIwDomu
/interface wifi configuration
add channel=wch2-AX-Podstawowy country=Poland datapath=dtpPelnyDostep \
disabled=no mode=ap name=cfg2-Podstawowy-PelenDostep security=\
secPelnyDostep ssid=DKW steering=strWIFIwDomu
add channel=wch5-AX-Podstawowy country=Poland datapath=dtpPelnyDostep \
disabled=no mode=ap name=cfg5-Podstawowy-PelenDostep security=\
secPelnyDostep ssid=DKW steering=strWIFIwDomu
add channel=wch2-AX-Podstawowy country=Poland datapath=dtpOgraniczonyDostep \
disabled=no mode=ap name=cfg2-Podstawowy-OgraniczonyDostep security=\
secOgraniczonyDostep ssid=Dekawka steering=strWIFIwDomu
add channel=wch5-AX-Podstawowy country=Poland datapath=dtpOgraniczonyDostep \
disabled=no mode=ap name=cfg5-Podstawowy-OgraniczonyDostep security=\
secOgraniczonyDostep ssid=Dekawka steering=strWIFIwDomu
add channel=wch2-AX-Drugi country=Poland datapath=dtpPelnyDostep disabled=no \
mode=ap name=cfg2-Drugi-PelenDostep security=secPelnyDostep ssid=DKW \
steering=strWIFIwDomu
add channel=wch5-AX-Drugi country=Poland datapath=dtpPelnyDostep disabled=no \
mode=ap name=cfg5-Drugi-PelenDostep security=secPelnyDostep ssid=DKW \
steering=strWIFIwDomu
add channel=wch2-AX-Drugi country=Poland datapath=dtpOgraniczonyDostep \
disabled=no mode=ap name=cfg2-Drugi-OgraniczonyDostep security=\
secOgraniczonyDostep ssid=Dekawka steering=strWIFIwDomu
add channel=wch5-AX-Drugi country=Poland datapath=dtpOgraniczonyDostep \
disabled=no mode=ap name=cfg5-Drugi-OgraniczonyDostep security=\
secOgraniczonyDostep ssid=Dekawka steering=strWIFIwDomu
/interface wifi
set [ find default-name=wifi2 ] configuration=cfg2-Podstawowy-PelenDostep \
configuration.mode=ap disabled=no mtu=1500 name=\
wifi-2-MikroTikDuzy-PelnyDostep
set [ find default-name=wifi1 ] configuration=cfg5-Podstawowy-PelenDostep \
configuration.mode=ap disabled=no mtu=1500 name=\
wifi-5-MikroTikDuzy-PelnyDostep
add configuration=cfg2-Podstawowy-OgraniczonyDostep configuration.mode=ap \
disabled=no mac-address=06:F4:1C:B6:7F:03 master-interface=\
wifi-2-MikroTikDuzy-PelnyDostep mtu=1500 name=\
wifi-2-MikroTikDuzy-OgraniczonyDostep
add configuration=cfg5-Podstawowy-OgraniczonyDostep configuration.mode=ap \
disabled=no mac-address=06:F4:1C:B6:7F:02 master-interface=\
wifi-5-MikroTikDuzy-PelnyDostep mtu=1500 name=\
wifi-5-MikroTikDuzy-OgraniczonyDostep
/ip pool
add name=poolOgraniczonyDostep ranges=192.168.17.51-192.168.17.254
add name=poolPelnyDostep ranges=192.168.16.51-192.168.16.254
add name=poolAutomatyka ranges=192.168.18.51-192.168.18.254
/ip dhcp-server
add address-pool=poolOgraniczonyDostep interface=vlOgraniczonyDostep name=\
dhcpOgraniczonyDostep
add address-pool=poolPelnyDostep interface=vlPelnyDostep name=dhcpPelnyDostep
add address-pool=poolAutomatyka interface=vlAutomatyka name=dhcpAutomatyka
/interface bridge port
add bridge=intMostek frame-types=admit-only-vlan-tagged interface=ether2
add bridge=intMostek frame-types=admit-only-untagged-and-priority-tagged \
interface=ether3 pvid=160
add bridge=intMostek frame-types=admit-only-untagged-and-priority-tagged \
interface=ether4 pvid=160
add bridge=intMostek frame-types=admit-only-untagged-and-priority-tagged \
interface=ether5 pvid=160
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=intMostek comment=vlPelnyDostep tagged=ether2,intMostek untagged=\
ether3,ether4,ether5 vlan-ids=160
add bridge=intMostek comment=vlOgraniczonyDostep tagged=intMostek,ether2 \
vlan-ids=170
add bridge=intMostek comment=Automatyka tagged=intMostek,ether2 vlan-ids=180
/interface list member
add interface=ether1 list=WAN
add interface=vlOgraniczonyDostep list=LAN
add interface=vlPelnyDostep list=LAN
/interface wifi capsman
set enabled=yes interfaces=vlPelnyDostep
/interface wifi provisioning
add action=create-dynamic-enabled comment=MalyMikroTik disabled=no \
master-configuration=cfg5-Drugi-PelenDostep name-format=\
wifi-5-%I-PelnyDostep radio-mac=04:F4:1C:B8:D3:6E slave-configurations=\
cfg5-Drugi-OgraniczonyDostep slave-name-format=\
wifi-5-%I-OgraniczonyDostep
add action=create-dynamic-enabled comment=MalyMikroTik disabled=no \
master-configuration=cfg2-Drugi-PelenDostep name-format=\
wifi-2-%I-PelnyDostep radio-mac=04:F4:1C:B8:D3:6F slave-configurations=\
cfg2-Drugi-OgraniczonyDostep slave-name-format=\
wifi-2-%I-OgraniczonyDostep
add action=create-dynamic-enabled comment=Lokalny disabled=no \
master-configuration=cfg5-Podstawowy-PelenDostep radio-mac=\
04:F4:1C:B6:7F:02 slave-configurations=cfg5-Podstawowy-OgraniczonyDostep
add action=create-dynamic-enabled comment=Lokalny disabled=no \
master-configuration=cfg2-Podstawowy-PelenDostep radio-mac=\
04:F4:1C:B6:7F:03 slave-configurations=cfg2-Podstawowy-OgraniczonyDostep
/ip address
add address=192.168.16.1/24 comment=vlPelnyDostep interface=vlPelnyDostep \
network=192.168.16.0
add address=192.168.17.1/24 comment=vlOgraniczonyDostep interface=\
vlOgraniczonyDostep network=192.168.17.0
add address=192.168.18.1/24 comment=vlAutomatyka interface=vlAutomatyka \
network=192.168.18.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server lease
add address=192.168.16.10 client-id=1:4:f4:1c:b8:d3:69 comment=\
ROUTER-KANCIAPA mac-address=04:F4:1C:B8:D3:69 server=dhcpPelnyDostep
add address=192.168.16.16 client-id=1:0:25:36:a1:a9:5d comment=DRUKARKA-OKI \
mac-address=00:25:36:A1:A9:5D server=dhcpPelnyDostep
/ip dhcp-server network
add address=192.168.16.0/24 comment=vlPelnyDostep dns-server=192.168.100.1 \
gateway=192.168.16.1
add address=192.168.17.0/24 comment=vlOgraniczonyDostep dns-server=\
192.168.17.1 gateway=192.168.17.1
add address=192.168.18.0/24 comment=vlAutomatyka dns-server=192.168.18.1 \
gateway=192.168.18.1
/ip dns
set allow-remote-requests=yes use-doh-server=https://dns.nextdns.io/XXXXXX \
verify-doh-cert=yes
/ip dns static
add address=192.168.17.1 comment=defconf name=router.lan type=A
add address=45.XX.XX.XX name=dns.nextdns.io type=A
add address=45.XX.XX.XX name=dns.nextdns.io type=A
add address=2a07:a8c0:: name=dns.nextdns.io type=AAAA
add address=2a07:a8c1:: name=dns.nextdns.io type=AAAA
add address=192.168.16.10 name=RouterKanciapa.lan type=A
add address=192.168.16.11 name=NAS.lan type=A
add address=192.168.16.16 name=DrukarkaOKI.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=input comment=\
"Blokada z zewn\C4\85trz zapyta\C5\84 DNS" disabled=yes dst-port=53 \
in-interface=ether1 protocol=udp
add action=drop chain=input comment=\
"Blokada z zewn\C4\85trz zapyta\C5\84 DNS" disabled=yes dst-port=53 \
in-interface=ether1 protocol=tcp
add action=drop chain=forward comment=\
"Blokada z zewn\C4\85trz zapyta\C5\84 DNS" disabled=yes dst-port=53 \
out-interface=!ether1 protocol=tcp
add action=drop chain=forward comment=\
"Blokada z zewn\C4\85trz zapyta\C5\84 DNS" disabled=yes dst-port=53 \
out-interface=!ether1 protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat comment=masquerade ipsec-policy=out,none \
out-interface-list=WAN
add action=redirect chain=dstnat comment=\
"Blokada z zewn\C4\85trz zapyta\C5\84 DNS" disabled=yes dst-port=53 \
in-interface=!ether1 protocol=udp
add action=redirect chain=dstnat comment=\
"Blokada z zewn\C4\85trz zapyta\C5\84 DNS" disabled=yes dst-port=53 \
in-interface=!ether1 protocol=tcp
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=ether1 type=external
add interface=intMostek type=internal
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=MikroTikDuzy
/system ntp client
set enabled=yes
/system ntp client servers
add address=tempus1.gum.gov.pl
add address=tempus2.gum.gov.pl
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard settings
set auto-upgrade=yes
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="\r\
\n :if ([system leds settings get all-leds-off] = \"never\") do={\r\
\n /system leds settings set all-leds-off=immediate \r\
\n } else={\r\
\n /system leds settings set all-leds-off=never \r\
\n }\r\
\n "
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="\r\
\n :foreach iface in=[/interface/wifi find where (configuration.mode=\"a\
p\" && disabled=no)] do={\r\
\n /interface/wifi wps-push-button \$iface;}\r\
\n "
AX2 (bridge) configuration:
##on router AX2
# 2026-01-15 12:16:49 by RouterOS 7.21
#
# model = C52iG-5HaxD2HaxD
/interface bridge
add frame-types=admit-only-vlan-tagged name=intMostek vlan-filtering=yes
/interface vlan
add interface=intMostek name=vlAutomatyka vlan-id=180
add interface=intMostek name=vlOgraniczonyDostep vlan-id=170
add interface=intMostek name=vlPelnyDostep vlan-id=160
/interface wifi datapath
add bridge=intMostek comment=defconf disabled=no name=dtpCAP
/interface wifi
# managed by CAPsMAN 04:F4:1C:B6:7E:FE%vlPelnyDostep, traffic processing on CAP
# mode: AP, SSID: DKW, channel: 5320/ax/eeeC/DI
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=dtpCAP \
disabled=no
# managed by CAPsMAN 04:F4:1C:B6:7E:FE%vlPelnyDostep, traffic processing on CAP
# mode: AP, SSID: DKW, channel: 2412/ax/Ce
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=dtpCAP \
disabled=no
add configuration.mode=ap disabled=no mac-address=06:F4:1C:B8:D3:6E \
master-interface=wifi1 name=wifi3
/interface bridge port
add bridge=intMostek frame-types=admit-only-vlan-tagged interface=ether1
add bridge=intMostek frame-types=admit-only-untagged-and-priority-tagged \
interface=ether2 pvid=160
add bridge=intMostek frame-types=admit-only-untagged-and-priority-tagged \
interface=ether3 pvid=160
add bridge=intMostek frame-types=admit-only-untagged-and-priority-tagged \
interface=ether4 pvid=160
add bridge=intMostek frame-types=admit-only-untagged-and-priority-tagged \
interface=ether5 pvid=170
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=intMostek comment=vlPelnyDostep tagged=ether1 vlan-ids=160
add bridge=intMostek comment=vlOgraniczonyDostep tagged=ether1 vlan-ids=170
add bridge=intMostek comment=vlAutomatyka tagged=ether1 vlan-ids=180
/interface wifi cap
set discovery-interfaces=vlPelnyDostep enabled=yes slaves-datapath=dtpCAP
/ip address
add address=192.168.17.10/24 comment=vlOgraniczonyDostep interface=\
vlOgraniczonyDostep network=192.168.17.0
add address=192.168.16.10/24 comment=vlPelnyDostep interface=vlPelnyDostep \
network=192.168.16.0
add address=192.168.18.10/24 comment=vlAutomatyka interface=vlAutomatyka \
network=192.168.18.0
/ip dhcp-client
add interface=intMostek
/ip dns
set allow-remote-requests=yes servers=192.168.100.1
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=MikroTikMaly
/system ntp client
set enabled=yes
/system ntp client servers
add address=tempus1.gum.gov.pl
add address=tempus2.gum.gov.pl
/system routerboard settings
set auto-upgrade=yes
The network topology:
ISP – eth1:AX3:eth2[192.168.16.1 / 192.168.17.1 / 168.168.18.1] (TAGGED VLAN 160, 170, 180) - [192.168.16.10 / 192.168.17.10/ 168.168.18.10]eth1: AX2
Rest of eth ports are in UNTAGGED VLAN 160
The current configuration is:
VLAN 160 (vlPelnyDostep) 192.168.16.XX is configured to use ISP’s DNS (192.168.100.1)
##on router AX3
/ip dhcp-server network
add address=192.168.16.0/24 comment=vlPelnyDostep dns-server=192.168.100.1 \
gateway=192.168.16.1
VLAN 170 (vlOgraniczonyDostep) 192.168.17.XX is configured to use NextDNS
##on router AX3
/ip dns
set allow-remote-requests=yes use-doh-server=https://dns.nextdns.io/XXXXXX \
verify-doh-cert=yes
/ip dns static
add address=192.168.17.1 comment=defconf name=router.lan type=A
add address=45.XX.XX.XX name=dns.nextdns.io type=A
add address=45.XX.XX.XX name=dns.nextdns.io type=A
add address=2a07:a8c0:: name=dns.nextdns.io type=AAAA
add address=2a07:a8c1:: name=dns.nextdns.io type=AAAA
##on router AX3
/ip dhcp-server network
add address=192.168.17.0/24 comment=vlOgraniczonyDostep dns-server=\
192.168.17.1 gateway=192.168.17.1
What I want is to use DNS server on AX2 for another NextDNS profile (or another supplier of DNS) for VLAN 160 (vlPelnyDostep) 192.168.16.XX, like
##on bridge AX2
/ip dns
set allow-remote-requests=yes use-doh-server=https://dns.nextdns.io/anotherprofile \
verify-doh-cert=yes
.....
/ip dhcp-server network
add address=192.168.16.0/24 comment=vlPelnyDostep dns-server=192.168.16.10 \
gateway=192.168.16.1
I have try like above but without success (DHCP does not allocate IP for clients)
That cannot be done, as I already wrote above.
I would probably change the dhcp server for this network on the AX3.
(change to dns-server=192.168.16.10)
And disable the dhcp server on the AX2.
After finding and fixing the error in configuration (I was not aware about need to define default route IP/Routes in case of static assigment IP address), my idea/configuration of running an independent DNS server on each Mikrotik router worked. At this moment I have two separate servers which redirect to different profiles in NextDNS; I can also freely assign it to my VLANS.
|--------------| |--------------|
| --------- | vlanA ..dns-server=DNS SERVER1.. | --------- |
| | DNS | | -------------------------------- | | DNS | |
| |SERVER1| | | |SERVER2| |
| --------- | vlanB ..dns-server=DNS SERVER2.. | --------- |
|INTERNET| --- | MIKROTIK AX3 | -------------------------------- | MIKROTIK AX2 |
| (ROUTER) | | (BRIDGE) |
---------------- ----------------