When having rules:
add action=accept chain=input comment=“Allow A.B.C.D” log=yes src-address=A.B.C.D
add action=drop chain=input comment=“Drop all” disabled=yes in-interface=internet
router cannot resolve DNS (located at the A.B.C.D address):
resolve domain-name=“fqdn” server=A.B.C.D
in fact, no resolving works when the second rule is active.
This is an outgoing DNS request, not a traffic initiated by the A.B.C.D server.
You should allow the answer for that established outgoing session.
See the default first rule : “defconf: accept established,related,untracked”
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
There is no need to accept input from server A.B.C.D for those DNS queries. (Better close that door ?)
Thanks.
Works now.
I didn’t expect that this would have to be explicitly set.