What is Google DNS doing here?

msatter · July 10, 2017, 7:31am

I am running my own local DNS when this happened only three devices where online of which one was my Mikrotik were powered up and none of them have Google as DNSserver. Could it be that the address of the DNS sever 8.8.8.8 is spoofed so that it seems that it comes from Google.
When a device in the internal network tries to contact a external DNS sever on port 53 UDP it will be redirected to my internal DNS sever and only when that not have the requested record in cache it will go out to the DNS sever of my ISP which has an other IP address then 8.8.8.8

Jul/10/2017 05:09:49 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:09:51 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:09:54 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:09:59 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:10:00 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:10:01 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:10:02 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:10:03 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:10:05 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:10:07 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:10:10 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:10:13 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:10:15 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:19 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:22 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:24 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:27 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:29 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:30 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:31 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:32 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:33 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:35 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:42 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:45 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:13:47 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:49 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:50 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:51 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:52 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:53 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:54 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:56 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:57 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:58 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:16:59 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:00 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:01 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:02 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:03 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:04 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:06 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:07 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:08 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:09 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:10 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:11 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:12 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:13 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:14 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:16 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:17 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:18 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:17:24 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:26 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:30 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:30 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:31 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:31 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:32 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:34 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:38 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:39 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:39 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:39 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:40 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:43 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:43 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:43 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:45 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:46 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:47 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:48 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:50 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:51 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:52 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:17:53 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:27 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 83
Jul/10/2017 05:24:29 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:32 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:35 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:36 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:36 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:40 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:40 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:42 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:43 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:43 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 67
Jul/10/2017 05:24:48 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:51 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:52 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:53 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:24:54 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:29:07 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:08 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:10 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:13 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:14 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:15 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:16 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:17 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:18 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:20 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:21 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:22 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:25 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:26 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:29:34 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 113
Jul/10/2017 05:31:30 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:31 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:33 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:34 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:36 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:37 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:37 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:41 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:42 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:44 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 67
Jul/10/2017 05:31:45 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:46 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:49 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:50 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:51 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:53 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:54 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:31:57 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:05 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:07 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:14 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:16 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:18 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:20 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 67
Jul/10/2017 05:35:20 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:22 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:22 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:23 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:25 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:27 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162
Jul/10/2017 05:35:28 firewall,info UDP Block prerouting: in:pppoe-out1 out:(none), src-mac xx:xx:xx:xx:xx:20, proto UDP, 8.8.8.8:53->xxx.xxx.xxx.xxx:28773, len 162

pe1chl · July 10, 2017, 8:04am

Some devices use Google DNS even when it is not configured.
Do a packet sniffer trace to see what DNS requests really are made.
When you receive replies to requests you did not make, you are the victim of source address spoofing.
MikroTik can do nothing about that. ISP’s all over the world should implement BCP38.

msatter · July 10, 2017, 8:30am

Thanks and I have not also TCP redirected to my DNS however the firewall there won’t allow TCP 53 so that it ends there. Maybe a TCP request can trigger a UDP response like Google is doing in the Speedy protocol on port 443.

BCP38 would solve a lot of problems and it is a responsibility of the ISP that source addresses they egress are real.

JimmyNyholm · July 10, 2017, 4:05pm

We are trying but Mikrotik is hindering us with non working uprf in vrf scenarios.

Mikrotik Please You are actually making the internet less secure and prone to spoof by lagging behind…

But then again. All should at least do what they can, where they can, to reduce the problem as much as possible. And that my friend we are.

Van9018 · July 10, 2017, 6:05pm

Use Tools > Packet Sniffer to view the content of the DNS queries. Or post the packet capture on this thread.

msatter · July 10, 2017, 8:23pm

Have activated a packet sniffer on port 53 incoming and it is written to a file on the SD-disk. The file is not direct readable and I assume Wireshark can read it.

Van9018 · July 10, 2017, 10:30pm

Yes - Wireshark can read it.

idlemind · July 11, 2017, 7:08pm

I’m not sure how urpf plays into this other than a perceived simpler way to implement it. Surely an ACL will suffice or at least get you some protection over perfect protection?

IntrusDave · July 11, 2017, 11:04pm

All Android based devices use Google DNS for things other than DNS. (Like how I use DNS to alert clients about blacklist updates)
These devices include Phones, Tablets, Refrigerators, Air Conditioners, notebooks, TVs, DVD/Bluray payers… the list goes on and on. I’ve found that if you are redirecting DNS to your internet DNS, it’s best to leave an exception for 8.8.8.8 and 8.8.4.4.

msatter · July 12, 2017, 8:58am

The only exception I am going to allow for the blacklist. If a device needs a special DNS access and won’t do with the provided DNS than it is a device I don’t need.