Windows DNS server

RouterOS Beginner Basics
1

I have removed the default config and and attempting to set up my RB2011UAS from scratch as a learning experence. I have been able to:
-bridge ports 2-5
-create a lan adress space of those ports
-create a dhcp client for eth1 (it connects to the ISP)
-create several basic rules for firewall and one NAT (masquerade) rule.
-My local Windows DHCP answers requests.
-LAN clients can see one another
-But I can’t browse the internet. I believe it’s a DNS issue. LAN clients are configured to as Windows DNS, and Windows forwards requests to RouterBoard device. When I look under IP-> DNS I see the Dynamic servers assigned by the ISP. What am I missing? Here is the config.

# jan/02/1970 00:36:13 by RouterOS 5.25
# software id = J1B5-ZIC3
#
/interface bridge
add admin-mac=D4:CA:6D:7C:66:A6 auto-mac=no l2mtu=1598 name=bridge-2-5
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys wpa-pre-shared-key=40270299C9DA wpa2-pre-shared-key=\
    40270299C9DA
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m
/interface bridge port
add bridge=bridge-2-5 interface=ether2
add bridge=bridge-2-5 interface=ether3
add bridge=bridge-2-5 interface=ether4
add bridge=bridge-2-5 interface=ether5
/ip address
add address=172.16.1.1/24 interface=bridge-2-5
/ip dhcp-client
add default-route-distance=0 disabled=no interface=ether1
/ip dns
set allow-remote-requests=yes servers=74.116.184.28
/ip firewall address-list
add address=172.16.1.0/24 list=LAN
/ip firewall filter
add action=drop chain=input connection-state=invalid
add action=drop chain=forward connection-state=invalid
add chain=input src-address-list=LAN
add chain=input connection-state=established
add chain=input connection-state=related
add action=drop chain=input
add chain=forward connection-state=new src-address-list=LAN
add chain=forward connection-state=related src-address-list=LAN
add chain=forward connection-state=established src-address-list=LAN
add action=drop chain=forward
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
2

I think the issue is the two local hops in your dns. Have your Windows DHCP server direct DNS directly to the router 172.16.1.1 instead dhcp server relaying you over to it.

3

Thanks fir your reply. This is way I usually the way I do it. The Windows server acts as forwarder and forwards all requests for external addresses to the router. It’s the M$ way :wink:
I’ve done it with other routers just trying to figure out how to do it with this one.

4

UPATE: After adding a layer-7 protocol, a couple of mangle rules, and nat rules I got a little further (I found them here https://www.dalemacartney.com/2012/12/29/dns-conditional-forwarders-with-mikrotik-routeros/.
I can confirm that DNS requests are going to the windows server, then fowarded to the router. I see the in the lookup being done by the router, and finally the dns cache is updated on the windows server. Somehow that last leg; the response from the server to the desktop fails, and I can’t figure out why. I temporarily disabled my drop rules to see if anything would change and it didn’t. Next stop wireshark. Here is my new config.

# jan/02/1970 00:34:27 by RouterOS 5.25
# software id = J1B5-ZIC3
#
/interface bridge
add admin-mac=D4:CA:6D:7C:66:A6 auto-mac=no l2mtu=1598 name=bridge-2-5
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys wpa-pre-shared-key=40270299C9DA wpa2-pre-shared-key=\
    40270299C9DA
/ip firewall layer7-protocol
add name=pegmicro.lan regexp=test.lan
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m
/interface bridge port
add bridge=bridge-2-5 interface=ether2
add bridge=bridge-2-5 interface=ether3
add bridge=bridge-2-5 interface=ether4
add bridge=bridge-2-5 interface=ether5
/ip address
add address=172.16.1.1/24 interface=bridge-2-5
/ip dhcp-client
add default-route-distance=0 disabled=no interface=ether1
/ip dns
set allow-remote-requests=yes servers=74.116.184.28
/ip firewall address-list
add address=172.16.1.0/24 list=LAN
/ip firewall filter
add action=drop chain=input connection-state=invalid
add action=drop chain=forward connection-state=invalid
add chain=input src-address-list=LAN
add chain=input connection-state=established
add chain=input connection-state=related
add action=drop chain=input
add chain=forward connection-state=new src-address-list=LAN
add chain=forward connection-state=related src-address-list=LAN
add chain=forward connection-state=established src-address-list=LAN
add action=drop chain=forward
/ip firewall mangle
add action=mark-connection chain=prerouting dst-address=172.16.1.1 dst-port=\
    53 layer7-protocol=test.lan new-connection-mark=test.lan-forward \
    protocol=udp
add action=mark-connection chain=prerouting dst-address=172.16.1.1 dst-port=\
    53 layer7-protocol=test.lan new-connection-mark=test.lan-forward \
    protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=dst-nat chain=dstnat connection-mark=test.lan-forward \
    to-addresses=172.16.1.2
5

**Update:**The above config worked. Had to do a winsock reset on the PC.