we have our webserver on local address 10.10.10.10. We have fully routed network, no NAT except main router masquarade. I wanted our customers to have access to our webserver, as there is web presentation of our town touristic portal. In the past I solved it with some DST NAT tricks, because we used NATted networks, etc. But with our new ISP and one central point I decided to simply put our locally hosted domains as static DNS entries onto our main router.
Users have DNS=gateway IP adresses. Each node runs DNS server too, and it is chained to our main router. No secondary DNS on subsequent nodes. But - there seems to be some odd behavior from time to time. It just happened for the second time in one month, when I was not able to get to the webserver, because what DNS returned was public IP adress, and not our internal, static one.
I would like to ask, if my understanding is correct, that no matter what, static entry has ALWAYS precedence. But if it is so, how subsequent nodes could get to the public address? This could mean one thing - there is some bug with OS 3.3 we run on our central router?
I also use MT for my DNS. At the end/core router I have a dst-nat rule which targets ALL port 53 UDP and TCP ports and dst-nat it to that router’s address. Under
I have two dst-nat firewall rules, one for port53 UDP and one for port53 TCP. It dst-nat all DNS requests to that router’s IP. I have setup that router to exclude all requests from that router. Under IP/DNS/Settings I specified my actual upstream DNS servers. For me it works like a dream.
Where 172.29.254.254 is the CORE (and DNS) router’s address. Be sure to exclude (=!) the IP on the interface of your gateway to your upstream DNS server.
The above rules basically dst-nat’s ALL dst:port53 traffic, EXCEPT when it’s coming from that router.
You could do it that way, but some clients like static IP addresses and use any DNS server they can think of. Then they complain to you about bad service, meanwhile the problem is on their side.
I prefer to FORCE everyone to use the DNS I want them to use.
If you setup your CORE/DNS router to use itself as primary, it won’t make any difference, as the CORE/DNS router will always check itself first anyway. And it is important to have a decent backup DNS server too.
Yes, according to your explanation you should use ether1’s IP. If you have more than one address on that interface and still not sure what address to exclude, you could setup an IP address list (/ip firewall address-lists) with all IP’s ON your CORE router, and choose =! under the advanced tab. This will make sure that none of the IP’s ON your router will be dst-nat’d.
Well, this is totally dumbfounding me. When ever I put the following rules in to place my x86 Router reboots instantly, starts up and then reboots itself again. Over and over.
The funny thing is that it only does this with the LAN cables plugged in. If I take them out, the router runs, and I am then able to log in to the CLI and disable the two rules.
These are the rules:
1 X ;;; Force DNS Cache
chain=dstnat action=dst-nat to-addresses=0.0.0.0-255.255.255.255
to-ports=53 src-address-list=!core-ip dst-port=53 protocol=tcp
2 X chain=dstnat action=dst-nat to-addresses=0.0.0.0-255.255.255.255
to-ports=53 src-address-list=!core-ip dst-port=53 protocol=udp
Where address list is:
Flags: X - disabled, D - dynamic
# LIST ADDRESS
0 core-ip 196.207.23.22
1 core-ip 172.16.1.253
2 core-ip 41.215.5.17
And my Interface / ip addresses are:
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
196.207.23.22/30 196.207.23.20 196.207.23.23 ether1
172.16.1.253/24 172.16.1.0 172.16.1.255 ether2
41.215.5.17/29 41.215.5.16 41.215.5.23 ether3
RouterOS is 3.10, on an Intel Pentium 3 with 512 Ram.
Can you see what I have done wrong with my rules? Also its very weird to see it cause a router reboot. I would expect stalled traffic or something instead.
The only funny thing I can see in your rules are the to-address. Usually 0.0.0.0 would be entered as 0.0.0.0/0 and not 0.0.0.0-255.255.255.255. I haven’t tried it your way, but don’t really want to risk a router rebooting. Perhaps you should mail to support, probably a ROS bug.
I would write the rules as follow:
1 X ;;; Force DNS Cache
chain=dstnat action=dst-nat to-addresses=0.0.0.0/0
to-ports=53 src-address-list=!core-ip dst-port=53 protocol=tcp
2 X chain=dstnat action=dst-nat to-addresses=0.0.0.0/0
to-ports=53 src-address-list=!core-ip dst-port=53 protocol=udp