[solved] DNS set to AdGuardHome docker container IP not being used.

Solnse · April 20, 2023, 4:29pm

I’ve got a raspberry pi that I was running pihole on and decided to move to AdGuardHome. Instead of installing directly on raspbian, i installed docker and wrote a compose file to pull AdGuardHome. Install works fine, configuration no problem, but when finished, my rb5009 seems to ignore the docker container’s IP and sends all DNS queries to my upstream ISP. I decided to spin up a pihole container, and it doesn’t get any requests either. I’m thinking maybe since it’s inside docker, the request doesn’t look like it’s coming from the LAN? I’m not much of a firewall guy so I’m not sure if one of my rules is interfering, or if I need to allow a certain type of tunnel.

any advice is appreciated.

# apr/20/2023 09:10:44 by RouterOS 7.8
# software id = NVZC-831S
#
# model = RB5009UPr+S+
# serial number = HDA08CJZJ94
/interface bridge
add admin-mac=18:FD:74:CF:67:FC auto-mac=no comment=defconf name=bridge
/interface veth
add address=172.17.0.2/16 gateway=172.17.0.1 name=veth1
/disk
add parent=usb1 partition-number=1 partition-offset=512 partition-size=\
    "31 004 294 656" type=partition
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk group-key-update=8h mode=dynamic-keys name=\
    DevoRoxy supplicant-identity=""
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=8h name=defconf
/container config
set ram-high=512 registry-url=https://registry-1.docker.io tmpdir=\
    usb1-part1/pull
/container envs
add key=MEM_LIMIT name=unifi value=512
add key=MEM_STARTUP name=unifi value=256
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=172.17.0.1/16 interface=*B network=172.17.0.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=30m
/ip cloud advanced
set use-local-address=yes
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.225 comment=AdGuardHome mac-address=44:07:0B:84:81:D2 \
    server=defconf
add address=192.168.88.107 client-id=1:dc:a6:32:3c:d0:bf mac-address=\
    DC:A6:32:3C:D0:BF server=defconf
add address=192.168.88.133 client-id=1:60:22:32:2d:2e:e9 mac-address=\
    60:22:32:2D:2E:E9 server=defconf
add address=192.168.88.135 client-id=1:f0:9f:c2:70:ae:11 mac-address=\
    F0:9F:C2:70:AE:11 server=defconf
add address=192.168.88.137 client-id=1:78:45:58:87:a7:93 mac-address=\
    78:45:58:87:A7:93 server=defconf
add address=192.168.88.73 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:95:be:bd:77:e0:89:97:6c mac-address=\
    0E:9F:CA:CE:7D:91 server=defconf
add address=192.168.88.72 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:f1:c3:5b:7a:86:5:c9:81 mac-address=\
    F6:E0:99:75:4C:F5 server=defconf
add address=192.168.88.71 client-id=1:6:f:21:98:21:7e comment=\
    "Turnkey Fileserver (Samba)" mac-address=06:0F:21:98:21:7E server=defconf
add address=192.168.88.30 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:44:68:85:44:bd:d9:e5:18 mac-address=\
    E2:9E:BA:61:5B:E1 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.88.225
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=hda08cjzj94.sn.mynetname.net list=mycloud
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment=Hairpin dst-address=\
    192.168.88.0/24 src-address=192.168.88.0/24
add action=dst-nat chain=dstnat comment="Port forwarding with cloud" \
    dst-address-list=mycloud dst-port=443 protocol=tcp to-addresses=\
    192.168.88.107 to-ports=443
add action=dst-nat chain=dstnat dst-address-list=mycloud dst-port=80 \
    protocol=tcp to-addresses=192.168.88.107 to-ports=80
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat disabled=yes dst-address=!192.168.88.107 \
    dst-port=53 protocol=udp src-address=!192.168.88.107 to-addresses=\
    192.168.88.107
add action=dst-nat chain=dstnat disabled=yes dst-address=!192.168.88.107 \
    dst-port=53 protocol=tcp src-address=!192.168.88.107 to-addresses=\
    192.168.88.107
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.88.107 \
    dst-port=53 protocol=udp src-address=192.168.88.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.88.107 \
    dst-port=53 protocol=tcp src-address=192.168.88.0/24
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-autodetect=no time-zone-name=America/Los_Angeles
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

the docker network info on the rpi(192.168.88.107)

chad@raspberrypi:~/docker $ docker exec -it c5a201e0ce33 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
26: eth0@if27: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0
       valid_lft forever preferred_lft forever

anav · April 20, 2023, 4:52pm

So you have one flat network.
Typically I would recommend…

(1) The DHCP server for the network where the adguard resides, have the server being the gateway as we need the adguard to be able to reach the internet for DNS. You already have this–>super!
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1

(2) Along the same line of logic, we need to provide an external resource for DNS to the adguard.
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,9.9.9.9 { just examples of common public DNS servers }

(3) Ensure you allow in forward rules for all users to access DNS server
add action=accept chain=forward in-interface-list=LAN dst-address=192.168.88.225 { not really required here as its within the same subnet so access already at layer 2, but perhasp you need rule for vpn traffic ??)

(4) Ensure all users are forced to adguard for DNS, except adguard of course.
/ip firewall address list
add address=192.168.88.225 list=exception

/ip firewall nat
add chain=dstnat action=dst-nat dst-port=53 in-interface-list=LAN protocol=tcp src-address=!exception to-address=192.168.88.225
add chain=dstnat action=dst-nat dst-port=53 in-interface-list=LAN protocol=udp src-address=!exception to-address=192.168.88.225

(5) Slightly modify input chain to make it clearer/better.
FROM
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
TO:
add action=accept chain=input comment=“only from LAN” in-interface-list=LAN
add action=drop chain=input comment=“drop all else”

(6) Same with this rule…
FROM:
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN

TO:
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“drop all else”

(7) Hairpin nat rule is in place —> super!

(8) mac-server by itself is not a secure protocol…
From
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list**=LAN**
TO
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list**=LAN**

Solnse · April 20, 2023, 6:07pm

thank you for the detailed response.
I’ve made the recommended changes, but still don’t see any traffic on adguardhome.

Did I miss something?

# apr/20/2023 11:05:22 by RouterOS 7.8
# software id = NVZC-831S
#
# model = RB5009UPr+S+
# serial number = HDA08CJZJ94
/interface bridge
add admin-mac=18:FD:74:CF:67:FC auto-mac=no comment=defconf name=bridge
/interface veth
add address=172.17.0.2/16 gateway=172.17.0.1 name=veth1
/disk
add parent=usb1 partition-number=1 partition-offset=512 partition-size=\
    "31 004 294 656" type=partition
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk group-key-update=8h mode=dynamic-keys name=\
    DevoRoxy supplicant-identity=""
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=8h name=defconf
/container config
set ram-high=512 registry-url=https://registry-1.docker.io tmpdir=\
    usb1-part1/pull
/container envs
add key=MEM_LIMIT name=unifi value=512
add key=MEM_STARTUP name=unifi value=256
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=172.17.0.1/16 interface=*B network=172.17.0.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=30m
/ip cloud advanced
set use-local-address=yes
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.225 comment=AdGuardHome mac-address=44:07:0B:84:81:D2 \
    server=defconf
add address=192.168.88.107 client-id=1:dc:a6:32:3c:d0:bf mac-address=\
    DC:A6:32:3C:D0:BF server=defconf
add address=192.168.88.133 client-id=1:60:22:32:2d:2e:e9 mac-address=\
    60:22:32:2D:2E:E9 server=defconf
add address=192.168.88.135 client-id=1:f0:9f:c2:70:ae:11 mac-address=\
    F0:9F:C2:70:AE:11 server=defconf
add address=192.168.88.137 client-id=1:78:45:58:87:a7:93 mac-address=\
    78:45:58:87:A7:93 server=defconf
add address=192.168.88.73 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:95:be:bd:77:e0:89:97:6c mac-address=\
    0E:9F:CA:CE:7D:91 server=defconf
add address=192.168.88.72 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:f1:c3:5b:7a:86:5:c9:81 mac-address=\
    F6:E0:99:75:4C:F5 server=defconf
add address=192.168.88.71 client-id=1:6:f:21:98:21:7e comment=\
    "Turnkey Fileserver (Samba)" mac-address=06:0F:21:98:21:7E server=defconf
add address=192.168.88.30 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:44:68:85:44:bd:d9:e5:18 mac-address=\
    E2:9E:BA:61:5B:E1 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.88.225,1.1.1.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=hda08cjzj94.sn.mynetname.net list=mycloud
add address=192.168.88.225 list=exception
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="only from LAN" in-interface-list=LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=accept chain=input comment="port forwarding" connection-nat-state=\
    dstnat
add action=drop chain=input comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment=Hairpin dst-address=\
    192.168.88.0/24 src-address=192.168.88.0/24
add action=dst-nat chain=dstnat comment="Port forwarding with cloud" \
    dst-address-list=mycloud dst-port=443 protocol=tcp to-addresses=\
    192.168.88.107 to-ports=443
add action=dst-nat chain=dstnat dst-address-list=mycloud dst-port=80 \
    protocol=tcp to-addresses=192.168.88.107 to-ports=80
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat disabled=yes dst-address=!192.168.88.107 \
    dst-port=53 protocol=udp src-address=!192.168.88.107 to-addresses=\
    192.168.88.107
add action=dst-nat chain=dstnat disabled=yes dst-address=!192.168.88.107 \
    dst-port=53 protocol=tcp src-address=!192.168.88.107 to-addresses=\
    192.168.88.107
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.88.107 \
    dst-port=53 protocol=udp src-address=192.168.88.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.88.107 \
    dst-port=53 protocol=tcp src-address=192.168.88.0/24
add action=dst-nat chain=dstnat dst-address=192.168.88.225 in-interface-list=\
    LAN protocol=tcp src-address-list=!exception to-ports=53
add action=dst-nat chain=dstnat in-interface-list=LAN protocol=udp \
    src-address-list=!exception to-ports=53
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-autodetect=no time-zone-name=America/Los_Angeles
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN

anav · April 20, 2023, 9:20pm

(1) No you did not!
Does this
/ip dns
set allow-remote-requests=yes servers=192.168.88.225,1.1.1.1

LOOK LIKE this.
ip dns
set allow-remote-requests=yes servers=1.1.1.1,9.9.9.9 { just examples of common public DNS servers }

Remember the logic, we are providing a means for adguard to reach the internet itself… not loop to itself in a circle.

(2) Missing a rule…
_add action=accept chain=input comment=“only from LAN” in-interface-list=LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy” _

Note what I suggested was…
add action=accept chain=input comment=“only from LAN” in-interface-list=LAN
add action=drop chain=input comment=“drop all else”
_add action=accept chain=forward comment=“defconf: accept in ipsec policy” _

(3) This needs to be removed
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan

(4) These need to be modified, CHAIN IS WRONG… Should be FORWARD
add action=accept chain**=input** comment=“port forwarding” connection-nat-state=
dstnat
add action=drop chain=input comment=“drop all else”

SEEMS LIKE
A. your attention to detail is POOR
B. you dont understand how firewall rules work with traffic flow… or dont understand firewall type rules in general…
If you dont understand something ask first, dont blindly config…

Case in point another error…
This is what I wrote…

/ip firewall nat
add chain=dstnat action=dst-nat dst-port=53 in-interface-list=LAN protocol=tcp src-address=!exception to-address=192.168.88.225
add chain=dstnat action=dst-nat dst-port=53 in-interface-list=LAN protocol=udp src-address=!exception to-address=192.168.88.225

This is what you put on the config…
add action=dst-nat chain=dstnat dst-address=192.168.88.225 in-interface-list=
LAN protocol=tcp src-address-list=!exception to-ports=53
add action=dst-nat chain=dstnat in-interface-list=LAN protocol=udp \ missing any kind of address
src-address-list=!exception to-ports=53

Solnse · April 21, 2023, 9:28pm

You are correct, that I am not much of a firewall expert. I do appreciate that there is a beginner forum here where we can ask questions. I am grateful for your responses so that I can learn further.

I analyzed your responses in great detail and I do see where my flaws were in my first attempt. I was trying to interpret the lines you suggested into actual implementation via the winbox gui. I did notice the difference between the drop all else lines, input vs. forward; a subtle difference that I didn’t catch the first time around (thinking it was the same rule) and have added the rules appropriately, I believe. I had panicked initially when I saw login failures via ssh and telnet (which I have since disabled anyway) after making changes, but I do think your recommended rules should catch all those, now. I believe I have also ordered them in a logical way.

here is my config. Let me know if I’ve made any other bone-head mistakes. I appreciate your time.

# apr/21/2023 14:08:07 by RouterOS 7.8
# software id = NVZC-831S
#
# model = RB5009UPr+S+
# serial number = HDA08CJZJ94
/interface bridge
add admin-mac=18:FD:74:CF:67:FC auto-mac=no comment=defconf name=bridge
/interface veth
add address=172.17.0.2/16 gateway=172.17.0.1 name=veth1
/disk
add parent=usb1 partition-number=1 partition-offset=512 partition-size=\
    "31 004 294 656" type=partition
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk group-key-update=8h mode=dynamic-keys name=\
    DevoRoxy supplicant-identity=""
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=8h name=defconf
/container config
set ram-high=512 registry-url=https://registry-1.docker.io tmpdir=\
    usb1-part1/pull
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=172.17.0.1/16 interface=bridge network=172.17.0.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=30m
/ip cloud advanced
set use-local-address=yes
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.107 client-id=1:dc:a6:32:3c:d0:bf mac-address=\
    DC:A6:32:3C:D0:BF server=defconf
add address=192.168.88.133 client-id=1:60:22:32:2d:2e:e9 mac-address=\
    60:22:32:2D:2E:E9 server=defconf
add address=192.168.88.135 client-id=1:f0:9f:c2:70:ae:11 mac-address=\
    F0:9F:C2:70:AE:11 server=defconf
add address=192.168.88.137 client-id=1:78:45:58:87:a7:93 mac-address=\
    78:45:58:87:A7:93 server=defconf
add address=192.168.88.73 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:95:be:bd:77:e0:89:97:6c mac-address=\
    0E:9F:CA:CE:7D:91 server=defconf
add address=192.168.88.72 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:f1:c3:5b:7a:86:5:c9:81 mac-address=\
    F6:E0:99:75:4C:F5 server=defconf
add address=192.168.88.71 client-id=1:6:f:21:98:21:7e comment=\
    "Turnkey Fileserver (Samba)" mac-address=06:0F:21:98:21:7E server=defconf
add address=192.168.88.30 client-id=\
    ff:ca:53:9:5a:0:2:0:0:ab:11:44:68:85:44:bd:d9:e5:18 mac-address=\
    E2:9E:BA:61:5B:E1 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip firewall address-list
add address=hda08cjzj94.sn.mynetname.net list=mycloud
add address=192.168.88.108 list=exception
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=input comment="only from LAN" in-interface-list=LAN
add action=drop chain=input comment="drop all else - input"
add action=accept chain=forward comment="internet traffic" in-interface-list=\
    LAN out-interface-list=WAN
add action=accept chain=forward comment="port forwarding" \
    connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else - forward"
/ip firewall nat
add action=masquerade chain=srcnat comment=Hairpin dst-address=\
    192.168.88.0/24 src-address=192.168.88.0/24
add action=dst-nat chain=dstnat comment="Port forwarding with cloud" \
    dst-address-list=mycloud dst-port=443 protocol=tcp to-addresses=\
    192.168.88.107 to-ports=443
add action=dst-nat chain=dstnat dst-address-list=mycloud dst-port=80 \
    protocol=tcp to-addresses=192.168.88.107 to-ports=80
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address=192.168.88.108 dst-port=53 \
    in-interface-list=LAN protocol=tcp src-address-list=!exception to-ports=\
    53
add action=dst-nat chain=dstnat dst-address=192.168.88.108 dst-port=53 \
    in-interface-list=LAN protocol=udp src-address-list=!exception to-ports=\
    53
/ip service
set telnet disabled=yes
set ssh disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-autodetect=no time-zone-name=America/Los_Angeles
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Unfortunately my original problem still exists. AdGuardHome is still not processing any DNS queries. However, I believe it’s related to the macvlan created in docker for the container, not being seen by RouterOS even though they have the identical subnet. There must be some way to bridge them so that I can send the DNS queries directly to the container IP:PORT.

anav · April 21, 2023, 9:49pm

I believe the IP address of the Adguard will be different from the IP of the docker (docker IP is transparent to the equation).
I will look at the latest config sometime this weekend.

Solnse · April 21, 2023, 10:24pm

yes, the rpi is .107, the container is .108 which is free on the mikrotik network.

anav · April 21, 2023, 11:52pm

What is the purpose of two addresses associated with the bridge?? I dont know how containers works but assuming you know.

THIS IS WRONG FORMAT…
add action=dst-nat chain=dstnat dst-address=192.168.88.108 dst-port=53
in-interface-list=LAN protocol=tcp src-address-list=!exception to-ports=
53
add action=dst-nat chain=dstnat dst-address=192.168.88.108 dst-port=53
in-interface-list=LAN protocol=udp src-address-list=!exception to-ports=
53

TO:
add action=dst-nat chain=dstnat dst-port=53 in-interface-list=LAN protocol=tcp src-address-list=!exception to-address=192.168.88.108
add action=dst-nat chain=dstnat dst-port=53 in-interface-list=LAN protocol=udp src-address-list=!exception to address=192.168.88.108

Solnse · April 22, 2023, 12:43am

I didn’t know how to deal with that. When I went into the ip/addressess/address list, it showed the 172.17.0.1/16 network in red with an unknown interface. This is actually the docker instance on the rpi. I double clicked it, and it forced me to choose an interface. I assumed it was better to choose the bridge than the wan on ether1, or any of the other ports. It is technically on ether8, which the physical rpi is on, but wasn’t sure how that would affect the other docker containers there… which are currently not running while I troubleshoot the adguardhome. I didn’t want to delete it, because I thought that might be counterproductive to my attempts to communicate with the rpi and the docker container on it… maybe it would ignore the rpi docker, then?

anav · April 22, 2023, 1:37am

Okay tomorrow will try to figure out what do with docker address etc…

Solnse · April 22, 2023, 2:09am

I am truly impressed. Again, such a subtle difference between dst-address and to-addresses.
I found those options and made the change.
I am now receiving traffic to the adguardhome container.
Thank you so much for your knowledge and for sharing your insight. It would take me ages to see the difference between dst-address and to-addresses. Do you know anywhere I can read what the differences are?

anav, Thank you for your patience. I am very grateful for your help.
Have an amazing day.

mkx · April 22, 2023, 9:05am

Perhaps in official (reference) guide?
https://help.mikrotik.com/docs/display/ROS/NAT#NAT-Properties

anav · April 22, 2023, 11:38am

Syntax is sometimes helpful MKX, but mostly for IT trained twerps (stated fondly of course)… What is more helpful for ‘normal’ folks is a story to along with those pages!
If you look at the standard syntax for port forwarding or dsntat.
add chain=dstnat action=dst-nat in-interface=WAN dst-port=XX protocol=tcp to-address=serverIP to=ports=YY

What it says is that the action we are going to perform for a certain bit of traffic is dstnat ( take some traffic and point it in some direction ).
The action is important because when you select chain dstnat, it drives what is available under the action table and when we choose action dst-nat,
one see this brings up additional entries in the ACTION pop-up menu, namely to-address and to ports ( the one we are interested in).

So looking at the rest of the line, we know we have decided to identify some traffic and push it somewhere.
The identify bit ( match traffic and take action) is the main principal of all the firewall rules. Nothing new but good to get a sense of.
So we are stating anything coming in from the WAN ( think external user coming in to a local server ) that is headed for a specific port with protocol.
Then the action, send it to the local (internal) LANIP of the server and to a specific port on the server.
Note if the destination port and the server port are different as in the example above we are doing port translation.
Often a port is blocked by an ISP and we need users to come at the router on a different port and we can use this rule to translate the incoming port to the required server port.
Note that if the dst port and server port are the same (no translation required), the server port entry is NOT required and is assumed by the router.

Now the syntax used in port forwarding is different for a fixed WAN IP, as we know with certainty which WANIP users will be heading to —> Hence
add chain=dstnat action=dst-nat dst-address=WANIP dst-port=XX protocol=tcp to-address=serverIP to=ports=YY

Slight difference to some but its actually important where both internal and external users use the local server. In the case of a fixed WANip there is no difference for both internal and external users, as they use the destination address of the WANIP and traffic works. (assuming admin doesnt want internal users to use local direct LANIP) However, in the case of dynamic WANIP, the matching rule states in-interface=WAN. Great for external users useless for internal users as their traffic will not work because they are not coming in from the outside so to speak. The solution typically is to use the same resource external users use in this case, a dyndns name or mynetname URL etc to identify the IP of the router and further we mimic the format of the fixed WANIP case.
First we need to make the appropriate firewall address list
/ip firewall
add address=dydnsURL list=myWANIP

The router resolves the address entry to the actual WANIP for us and we use the format and note the use of destination-address-list ( like dst-address in fixed WANIP format )
add chain=dstnat action=dst-nat dst-address-list=myWANIP dst-port=XX protocol=tcp to-address=serverIP to=ports=YY

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Knowing the back ground story, we can now discuss the DST NAT rules for forcing users to adguard…
Just as we forced incoming users to a server!!!
We need to identify traffic for matching purposes and the send it to the correct location.
add action=dst-nat chain=dstnat dst-port=53 in-interface-list=LAN protocol=tcp src-address-list=!exception to-address=192.168.88.108
add action=dst-nat chain=dstnat dst-port=53 in-interface-list=LAN protocol=udp src-address-list=!exception to address=192.168.88.108

So we identify the type of chain and action we want (dst nat). Because users are heading somewhere… in this case everyt ime they are heading to the internet, the first thing that happens is DNS lookup. Which means they are heading for port53…whether they know it or not. Our job is to identify/match that traffic and send it to adguard.

So we state any traffic heading to port 53 (identifies the dst part), and traffic coming from somewhere, in this case the LAN. So far so good we are almost ready to send that traffic to the server or location we want to send it. However in the case of adguard, it has to go out the internet to get DNS for us and thus we dont want to tell it to loop back to itself otherwise it would never reach the internet. ******** So we need to exclude adguard from being identified. In addition you may have some subnets or other users that need to be excluded from being forced to adguard for DNS, and hence why we create the firewall address list…
/ip firewall
add address=193.168.88.108 list=excluded
add address=subnetX list=excluded
add address=userB list=excluded

So to properly focus on all lan users EXCEPT those to be excluded we add the matching bit src-address-list=!excluded. Which then turns the identification/matching bit to say all from LAN that are NOT on the excluded list. Without the exclamation mark, just to understand the rule would have changed to ONLY force those coming from the LAN and are on the source address list. Then of course we state where does this traffic go… to the to-address!.

In this case, unlike port forwarding, there is no destination address involved, we are not looking where external traffic is pointing as part of the identification/matching process, just internal local network flow heading for a particular port.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

My understanding is that we ensure Adguard has a path (requires a path) to the internet for AT LEAST the initial connection when using DOH servers, to be able to reach the DOH server after which its traffic is transparent.

anav · April 22, 2023, 11:55am

Glad you want to take the time to understand each rule, THIS IS THE WAY!!

mkx · April 22, 2023, 12:30pm

The help page I was referring to, also includes these two explanations:

dst-address (IP/netmask | IP range; Default: )
Matches > packets whose destination is equal to specified IP or falls into a specified IP range.

to-addresses (IP address[-IP address]; Default: 0.0.0.0)
Replace the original address with the specified one> . Applicable if action is dst-nat, netmap, same, src-nat

(the highliting is mine)
I wouldn’t say that this is only syntax explanation. Would you?

And that’s why I linked that page when previous poster asked about where he could read more about differences between these two properties.
I’m glad that you’re willing to offer your explanation (and story) to less experienced users, but I guess there’s a point where toddlers need to learn how to use reference material instead of asking (grand)dad about everything

anav · April 22, 2023, 1:06pm

I think they go hand in hand but yes, one should know where all the applicable resources are located but the one liners on syntax pages dont exactly educate new users…

Solnse · April 22, 2023, 3:41pm

anav, Thank you for writing that up. It makes sense, and I see further flaws in my assumptions. I assumed dst-nat meant dst(destination)-nat so that’s why I had put the destination address under dst-address. Your explanation is clear that it’s just a tag for the type of action being taken, and so it makes sense that the dst-port is 53 (any call to port 53 which we know is DNS traffic) triggers this rule, and as you explained, since the destination port is the same, it’s assumed, so we only need the target address (to-addresses).

That explanation does make it easier to RTFM. There’s a lot of new terms thrown out in the docs, even though it’s not completely indecipherable to me as an application developer. Networking vernacular, especially the intricately configurable RouterOS, is somewhat different than discussing tuples and Class hierarchy.

Thank you again.