Community discussions

MikroTik App
 
User avatar
anav
Forum Guru
Forum Guru
Topic Author
Posts: 19322
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Understanding DNS on MT

Wed Mar 28, 2018 10:44 pm

DNS hmmmmm I am piss poor at understanding how DNS works on any router but suggest at the DCHP server settings under the NETWORK TAB, there is a spot, normally blank for you to put in the DNS server of your choice vice the default ISP ones normally used. If I am not mistaken the Mikrotik will use the ones you setup first (can be more than one) prior to using the ISP DNS servers???

On the other hand there is a more direct IP DNS settings tab. Here one can see a blank spot at the top perhaps to add servers and below this it shows the default ISP DNS servers being used.
However at this spot I am not sure what use this SINGLE setting is if you have TWO WANS? The DHCP server Network Tab seems more useful in that you are telling each network to use a specific DNS server.

I would like to kinow the purpose and hierarchy of this IP DNS Tab.
For example if one puts a specific DNS server under the IP DNS Tab does that automatically override the default DNS servers from the ISPs for the dual WAN scenario??
For example if one puts a specific DNS Server under the IP DNS Tab does that automatically override the DHCP SERVER DNS additions one could make at the Networks Tab?
What is the relationship??
 
User avatar
jspool
Member
Member
Posts: 469
Joined: Sun Oct 04, 2009 4:06 am
Location: Oregon

Re: Understanding DNS on MT

Wed Mar 28, 2018 10:56 pm

I think you will find that quite a few use public DNS servers and not the ones from their local provider. In that scenario it doesn't matter what route your taking.

If allow remote request is enabled on the router the DNS server in dhcp server networks can be the local IP of the router and the router will use whatever you have set in the DNS server fields or what it has received from dhcp-client if use-peer-dns is checked.

You can also set a static DNS mapping by specifying the servers you want a network to use in dhcp server networks DNS server. In this case they will always get the set values from the dhcp server.
 
User avatar
anav
Forum Guru
Forum Guru
Topic Author
Posts: 19322
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Understanding DNS on MT

Thu Mar 29, 2018 5:38 am

Maybe its the vino, but I didnt grasp a single thing you said as none of it seem related to the pointed questions I asked.
 
Sob
Forum Guru
Forum Guru
Posts: 9120
Joined: Mon Apr 20, 2009 9:11 pm

Re: Understanding DNS on MT

Thu Mar 29, 2018 6:25 am

Resolvers used by router go in "/ip dns". You can add them manually or get them from ISP's DHCP, if you enable that option in DHCP client on WAN.

In "/ip dhcp-server" you set what DHCP server on router should give to its clients in LAN. Basically there are two options, either give them some outside resolvers and let them send queries there directly. Or use router's address and clients will use router as their resolver. Router has cache, so it can shave off few milliseconds from response time, if the answer is already cached. Don't forget to enable remote request in "/ip dns".

There's no special handling for dual WAN DNS. Either use something available from anywhere (e.g. Google's 8.8.8.8 and 8.8.4.4), or you must make sure to route queries to ISP's resolvers to the right ISP. It might not be exactly straighforward if it's all dynamic.
 
User avatar
jspool
Member
Member
Posts: 469
Joined: Sun Oct 04, 2009 4:06 am
Location: Oregon

Re: Understanding DNS on MT

Thu Mar 29, 2018 7:16 am

Generally there is not much point in using the local ISP DNS servers. Just set Google or OpenDNS servers or whatever you decide and it will work regardless of which WAN you route the traffic out.
 
User avatar
Steveocee
Forum Guru
Forum Guru
Posts: 1120
Joined: Tue Jul 21, 2015 10:09 pm
Location: UK
Contact:

Re: Understanding DNS on MT

Thu Mar 29, 2018 7:43 am

It's my buddy anav! You go steady on that vino, I've heard it damages your memory.

DNS hmmmmm I am piss poor at understanding how DNS works on any router but suggest at the DCHP server settings under the NETWORK TAB, there is a spot, normally blank for you to put in the DNS server of your choice vice the default ISP ones normally used. If I am not mistaken the Mikrotik will use the ones you setup first (can be more than one) prior to using the ISP DNS servers???

In the DHCP network tab, this blank entry makes the MikroTik hand out what it gets dynamically (or it has set to statically) as it's DNS server. This setting is useful if you want specify different servers per network.

On the other hand there is a more direct IP DNS settings tab. Here one can see a blank spot at the top perhaps to add servers and below this it shows the default ISP DNS servers being used.
However at this spot I am not sure what use this SINGLE setting is if you have TWO WANS? The DHCP server Network Tab seems more useful in that you are telling each network to use a specific DNS server.

The 2 blanks are for you to set your own DNS servers, the greyed ones below (if any) are dynamically gained, multi WAN's means multiple servers in these boxes and MT goes through them in descending order. The previously mentioned DHCP Network setting is perfect in this situation if you have 2 WANs and 2 networks or good also in failover if using them dynamically.

I would like to kinow the purpose and hierarchy of this IP DNS Tab.
For example if one puts a specific DNS server under the IP DNS Tab does that automatically override the default DNS servers from the ISPs for the dual WAN scenario??
For example if one puts a specific DNS Server under the IP DNS Tab does that automatically override the DHCP SERVER DNS additions one could make at the Networks Tab?
What is the relationship??


Static>Dynamic1>Dynamic2
A static DNS entry overrides any dynamic entry.
If you specify a DNS server in the IP>DHCP>Network tab then that overrides any other setting.

***HTH ( and apologies for any keyboard borks, I've been up since 4:30am with my youngest who is ill and she insisted on full on smashing her hands onto my keyboard as I typed this reply.
 
User avatar
anav
Forum Guru
Forum Guru
Topic Author
Posts: 19322
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Understanding DNS on MT

Thu Mar 29, 2018 5:06 pm

Ahhh Stevo, what a gread Dad you are!! Hoping you are getting your beauty rest while I read through your response once more.
By the way, thanks for answering in a way that is coherent and to the questions directly. Half the battle is the sender and only half is my responsibility, the reader LOL

Lets see how close I am to understanding

a. No entry in IP DNS and no entry in DHCP Server Networks Tab = clients use dynamic DNS servers provided by the ISP that the network/LAN is exiting the router on (routed).
b. No entry in IP DNS and network gateway address (192.168.0.1) in DHCP Server Networks Tab = clients go through the Network Gateway for DNS resolving which in effect is the same as a. , but takes advantage of the fact that MIKROTIK will provide some level of caching and speed up internet access (if so at what cost to CPU?)

c. Manual entry of goggle on IP DNS and no entry in DHCP Server Networks Tab = clients on any network will be sent to google DNS servers first, if not available back to a or b.
d. Manual entry of google on IP DNS and one network (A) of the two has OPEN DNS set on DHCP Server Network Tab = clients will go to google Tab except for those on Network A which will get routed to OPen DNS. If OPEN DNS is not available clients on NEtwork A would then get sent to Google, and finally if googel not available all clients would go through their dynamic ISP settings as per a, b.

For the above to be true ALLOW REMOTE REQUESTs must be checked!

Q. What is the function of the DHCP Client (ISP side) checkbox for USE PEER DNS???

[Just for completeness, I have port 53 in ip firewall rules input chain send to address list ----> ip raw rules prerouting chain drop address list]
 
User avatar
Steveocee
Forum Guru
Forum Guru
Posts: 1120
Joined: Tue Jul 21, 2015 10:09 pm
Location: UK
Contact:

Re: Understanding DNS on MT

Sat Mar 31, 2018 11:59 pm

Lets see how close I am to understanding
a. No entry in IP DNS and no entry in DHCP Server Networks Tab = clients use dynamic DNS servers provided by the ISP that the network/LAN is exiting the router on (routed).
Yep.
b. No entry in IP DNS and network gateway address (192.168.0.1) in DHCP Server Networks Tab = clients go through the Network Gateway for DNS resolving which in effect is the same as a. , but takes advantage of the fact that MIKROTIK will provide some level of caching and speed up internet access (if so at what cost to CPU?)
Kind of. WIll only work if the option is checked to respond to external requests in IP>DNS as per one of your final comments.
c. Manual entry of goggle on IP DNS and no entry in DHCP Server Networks Tab = clients on any network will be sent to google DNS servers first, if not available back to a or b.
Yep
d. Manual entry of google on IP DNS and one network (A) of the two has OPEN DNS set on DHCP Server Network Tab = clients will go to google Tab except for those on Network A which will get routed to OPen DNS. If OPEN DNS is not available clients on NEtwork A would then get sent to Google, and finally if googel not available all clients would go through their dynamic ISP settings as per a, b.
Yep
For the above to be true ALLOW REMOTE REQUESTs must be checked!
Yep, remember the firewall to drop from the WAN though.
Q. What is the function of the DHCP Client (ISP side) checkbox for USE PEER DNS???
To pick up any DNS server the DHCP server may be handing out, I personally always advise to use the ISP if it is available as it will always naturally be the shortest hop away and fastet to respond. Quick example;
My ISP:3ms
Google:12ms
Just for completeness, I have port 53 in ip firewall rules input chain send to address list ----> ip raw rules prerouting chain drop address list
This is as per your email I take it. Yeah, why not? You could simply just drop the DNS requests in RAW from the outside world, do you "really" need them in a list?
You could blackhole them for even less resource to be used.
If you were "just" going to drop them then do it through normal firewall unless CPU is extremely tight.

Who is online

Users browsing this forum: No registered users and 24 guests