Sporadic DNS failures

RouterOS General
1

I’m trying to run a DNS in my core router that allows me to address my subscribers by name and tower, e.g., JoeSmith.Springfield.MYTLD, by entering them in a static table. It turns out that this function works 100% fine, but the normal DNS function sporadically fails for anyone using our local DNS service.

The most common failure mode is that randomsite.com will resolve perfectly, but foo.bar.randomsite.com will hang instead of resolving correctly. There are other cases where the DNS search hangs as well, and often enough to really impede a subscriber’s use of the network. In all cases, setting up the subscriber’s CPE to use a public DNS instead of our core router DNS gets around the problem, but I would like to FIX the problem.

Has anyone experienced behavior like this? What is the cause? DNS looks simple enough to configure, so I can’t imagine what I could have done to cause this. I have three external public DNS addresses defined and the “allow remote requests” switch on.

2

I’am having such issues from time to time, only fix I found was rebooting.

3

Do you have DNS ‘max-udp-packet-size’ parameter set to default value of 512?
If yes, increment it to min. 4096, max. is 65500.

HTH,

4

Thanks for the suggestion. I have done so, and now I will see how well it works. If it solves the problem, I will suggest to MikroTik that they set a more reasonable default for the packet size.

5

This solved my problem perfectly. Thank you!

6

Additional experience showed that this did NOT solve my problem. However, RouterOS 5.18 had a DNS bug fix in it, and I have not seen the problem since then.

7

I´m new to Mikrotik. I have a RB750GL as firewall/router with an ADSL-connection. Using SW 5.21. The router has been running perfect for about a month. Suddenly it becomes unstable, and I believe I note the problem to be DNS-relatedl I reduced the “Max UDP Packet Size” to 512, and flushed the cache - and now it works again. Found the 512 value in another thread to possibly help - don´t know if or why, though.
Is this something known or common? Is there a known resolution, or shall I expect the flush the cache monthly to secure stable networking?

Grateful for advice.

8

Perhaps if you would describe exactly how your router is “going unstable,” we could provide better advice.

9

Well, I am unable to connect to sites on the Internet - if I then try a “nslookup” in a terminal I get no response. I have a DHCP-connection to my ISP over ADSL.

When I fail to connect to Internet, I have tested nslookup and these coincide. Have talked to my ISP and they promise no disturbancies.

10

Switched back to my old WRT-54GL using Tomato FW to see if the problem persists. If so, I will remain using it until I see evidence this issue is resolved.. Strange and sad…

11

Now I have the opportunity to try my 750 GL again. Any hints on what to check if/when it becomes unstable again?

12

to tell you anything we would like to see more details about configuration, like what you have under /ip dns, and how is your PC configured (what address is used to resolve host names)

Also, does simple IP ICMP messages are working w/o problems

13

Hi, thanks for looking into this.

The router is for the moment working OK again. Had it shutdown for 2 days while using an alternate router. As soon as I changed router the network worked like a charm again…

Enclose printouts from /IP/DNS:

servers:
dynamic-servers: 195.67.199.36,195.67.199.37,195.67.199.38
allow-remote-requests: yes
max-udp-packet-size: 4096
cache-size: 4096KiB
cache-max-ttl: 1w
cache-used: 85KiB

/Uffe

14

at a glance everything looks in order. Some notes

max-udp-packet-size: 4096 - for use with DNSSEC you have to allow larger packages. Usual size of 512 bytes was good for pre DNSSEC era.

15

Thanks.

OK, shall I increase the 4096 value, then? To which value?

16

it is already set to reasonable value that DNSSEC will work.

17

OK, thanks.

Strange enough, a few days ago when the router broke down I had the exact same settings. If I want to try to trace the fault if it reappears - what shall I focus upon?

Any loggings I can do?