Hi all,
Starting December I’m happily using a RB1100AHx2 to replace a Netgear WNDR3800 running OpenWRT. It was a necessary upgrade to have enough grunt to run a 100Mbps IPsec tunnel.
DHCP and DNS services used to be running on the WNDR3800 on Dnsmasq. Unfortunately RouterOS’ DNS functionality is a bit limited, i.e. it doesn’t do conditional forwarding for DNS lookup for remote network at the other end of the IPsec tunnel nor does the DHCP integrate with it to provide DNS for the local network.
Of course I could just use static records on both sides for the resources I need across the tunnel but that of course would (A) require manual labour in keeping things up-to-date and (B) be too easy 
.
While I’ve tried the Layer7 mangling of DNS packages for the conditional lookup, in the end I’ve decided to just stick up a BIND server on a Raspberry Pi and configure it properly as I ran into issues with Active Directory integration of my NAS.
The final obstacle now is to dynamically create DNS records for DHCP clients.
Again of course I could just deploy ISC DHCP on the RPi as well or replace BIND with Dnsmasq and effectively go back to the working situation I had using OpenWRT. However I do like keeping the DHCP RouterOS based as it’s easy to manage the leases when things change. So I’ve create a DHCP lease script which utilises the /tool dns-update application to update the records at the BIND serving running on the RPi.
After some initial problems with BADSIG errors, which I think is due to a bug (?) in the /tool dns-update encryption when using capitals and/or special characters (in my case underscore) for the username (it worked using the same configuration with the nsupdate tool from my local computer), I’ve managed to get things working with just using lowercase alphanumeric characters for the username and generating a new key based on that.
Using the /tool dns-update utility in RouterOS I can update A records, however it can’t update PTR records for reverse lookup nor can I delete records when the leases expire or are removed (which unnecessarily polutes the zone databases).
Is there any chance that the functionality of /tool dns-update can be expanded to create PTR records and delete records with a BIND server? Do you have any alternatives that would allow me to do this?
Regards, Magchiel