VLAN DNS

RouterOS Beginner Basics
1

I recently reset my router - so its at default configuration which works fine for me.
I’ve added a couple of DNS conditional forwarders but I read that I can now do this a different way to the config in the file attached; via /ip dns static add. The conditional forwarders are important for access to internal resources and domains.

I want to move all my virtual machines onto a Microtik managed VLAN as opposed to the existing VM defined VLAN arrangement.
I have the VLAN and it’s IP and DHCP all working fine.

I can ping out to 8.8.8.8 and route ok between the VLAN and the WAN (LTE interface).
However:

  • I want to be able route between the LAN and the VLAN
  • I want to use the routers builtin DNS server for the VLAN as well as the LAN [the LAN works ok]

If I set the DNS server in the DHCP scope for the VLAN to 192.169.1.1 [the router VLAN IP address] or 192.168.1.1 [the router bridge IP address] - DNS just times out. If I set it to 8.8.8.8 it works fine. The reason for needing to use the router DNS is so that the conditional forwarders in use on the router which give access to services and domains on the ethernet [physical wire] are accessible to the VLAN clients.

Is this just a firewall problem I am wondering ?

When I add add chain=input action=accept in-interface-list=VLAN2 comment=“Allow VLAN2” - it does not work, simply because I do not have a VLAN2 in the interface list, It is defined [or shows] as a child of ethernet1.

How do I fix this situation?

2

I have the answer now.

Routing works anyway - I don’t know why it wasn’t working before.
For DNS.

There is ONE slot available in /ip dns static which can be consumed with the forwarding rule of choice.
A second forwarder can constructed in the firewall to layer7 inspect port 53 traffic and forward it if a specific domain is being requested.
But again, this only seems to work for one domain name.
Second, third and fourth domain names are not handled.

A packet sniff on the router shows all DNS calls being incorrectly routed to the first forwarder regardless of the domain name. So I guess its only looking at the port number really.