Community discussions

MikroTik App
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Need help with using an internal DNS

Fri Apr 27, 2018 5:23 pm

I need help setting this up, I have a Ham Radio Wireless Mesh nodes running AREDN firmware. These nodes us 10.x.x.x addressing, so I have mine natted to my network at 192.168.1.200. Everything on that network has a domain of .Local.Mesh, I can't just point the .local.mesh traffic to that node, but the node does handle the DNS for that system. so what I am trying to do is setup the MikroTik with 2 DNS entries. The first will be 192.168.1.200, and the second will be a Public DNS like 88.8.8. or 1.1.1.1. This configuration should work, but I Know that Mikrotiks handle things a bit different on some items. I know I had to set up a Hairpin NAT when I was getting my webserver online, so that got me wondering, do I need to set up a NAT rule or something like that to get this working. I know many other people that do this same approach with their DNS entries with different routers, so I'm hoping its just an issue offiguring out the diferences in the Mikrotik configuration. I will warn you up front, I know enough about routing and MikroTiks to get myself in trouble, so if you have a solution, don't give it to me as a veteran Network engineer. Thanks in advance for any info
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Mon Apr 30, 2018 11:42 pm

judging by the fact this hs been posted for 3 days with no response, I'm starting to wonder if this is even possible. can someone at least tell me is that is the case? if I cant get this working, I will have to pull out the Mikrotik router and go back to Untangle, and I really don't want to do that. Is there another solution to my problem?
Last edited by kd7vea on Fri May 04, 2018 12:55 am, edited 1 time in total.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 1:08 am

Generally the configuration of DNS resolvers doesn't work as you want it to. It's not "ask this one first and if it doesn't know, ask another one". It's assumed that all are equal and have the same info. So mixing standard resolvers with others that know about some special local domain is not possible, because the public ones will never know about internal domain, they will tell the client that domain doesn't exist and that's it. But it's a feature that people need, so normal resolvers allow to configure per-domain forwarding, i.e. that queries for some domains should be send to another upstream resolver.

Unfortunately, in this regard, RouterOS is not normal and this useful feature is not supported. There's only L7 hack which has some limitations, but may be good enough for you.
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 10:25 am

The problem is rather that it is hard to understand from your description what you actually want.

If you want to assign different DNS servers to different clients using DHCP, then this is not a problem as long as you assign the same DNS servers to all clients in the same subnet.

/ip dhcp-server network
is the place where you bind the client's IP subnet with the settings to be provided for clients from that subnet.

Only one instance of DNS can run on Mikrotik itself, which the Mikrotik uses both for its own queries (e.g. when upgrading software or when you ping a domain name from Mikrotik itself) and for client queries if these clients have been configured with Mikrotik's IP as their DNS server. Here it is possible to define static entries like
server1.myowndomain.here
which will only be visible to clients using Mikrotik as their DNS server and the Mikrotik itself.

If you need more complex scenarios, like clients from a single subnet using different DNS servers, you can tell all clients to use Mikrotik itself as DNS, but use rules in
chain=dstnat
of
/ip firewall nat
rules together with
/ip firewall address-list
to redirect queries coming from some clients (whose addresses are on the
address-list
) to external DNS servers.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 6:39 pm

Thanks for the replies. Sob, I have attempted the L7 hack, but couldn't get it working, but if that is the only option as of right now, I will give it another shot.

Sindy, it looks like there is really only one option for this right now, but I will try to explain it better. I have a Private wireless network that spans several thousand square miles. We use Ubiquiti commercial gear on top of mountain tops with Custom Mesh firmware running on them. Every device on that network is assigned a WiFi address in the 10.x.x.x range, and on the Lan side gets a 10.x.x.x address. This is meant to replace an internet connection in an emergency so that Local government agencies/Red cross can still send data. everything on that network has a domain of .local.mesh. I use my Ubiquiti Rocket with the custom Firmware to connect to that network(I have several devices on that system (Email server, Web server, PBX, Samba server, GPS NTP server...) so I like to be able to access that network through my home network. Basically, if the Host name ends in .local.mesh, It needs to be routed to my NATed Ubiquiti rocket, and everything else should just go out to the internet as usual.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 7:02 pm

Try this:
/ip firewall layer7-protocol
add name="dns for local.mesh" regexp="\\x05local\\x04mesh.\\x01"
/ip firewall nat
add action=dst-nat chain=dstnat protocol=udp dst-port=53 in-interface=<LAN> \
    layer7-protocol="dns for local.mesh" to-addresses=<local.mesh DNS server>
Known limitations:
- Works only for udp, not tcp (but clients don't usually use tcp).
- Works only with IPv4, not IPv6.
- It bypasses cache in router (in case you use it as resolver for clients), but it's not hard to live with it.
- Router itself won't be able to use it without another extremely ugly hack.
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 7:45 pm

OK. So you have two DNS servers, both outside Mikrotik, and each is part of a distinct DNS network or hierarchy, so the private one won't resolve names like
whatever.com
while the public one won't resolve things like
something.local.mesh
.

And the goal is to send the query to the proper DNS network depending on the domain queried.

So I'm all for what @Sob has just posted, with two minor modifications
  • the tail of the match pattern is not
    .0x01
    (any byte followed by
    0x01
    byte) but
    0x00
  • it is a waste of resources to use the complex and resource-intensive
    layer7-protocol
    matcher, you can get the same results if you use just
    /ip firewall nat
    add action=dst-nat chain=dstnat content="\05local\04mesh\00" dst-port=53 protocol=udp to-addresses=ip.of.mesh.dns.server
    

    (yes, the syntax for specifying bytes as hex codes is different for the two matchers, it's not a typo).
And don't forget that you cannot test it from the Mikrotik itself, you must test it from clients, as locally originated packets do not pass through the
dstnat
chain. Of course the client must be set to use a DNS server from the public network by default.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 7:59 pm

Sob I appreciate your help, but unfortunately, it still does not work. I just don't understand why I cant get this to work. this was so simple with Untangle, but I am determined to run MikroTik.
I will Paste the exact code that I ran to be sure I haven't missed anything.
[admin@MikroTik] > ip firewall layer7-protocol
[admin@MikroTik] /ip firewall layer7-protocol> add name="dns for local.mesh" regexp="\\x05local\\x04mesh.\\x01"
[admin@MikroTik] /ip firewall layer7-protocol> ..
[admin@MikroTik] /ip firewall> nat
[admin@MikroTik] /ip firewall nat> add action=dst-nat chain=dstnat protocol=udp dst-port=53 in-interface=ether2 layer7-protocol="dns for local.mesh" to-address=192.168.1.200
[admin@MikroTik] /ip firewall nat>

I just want to be sure that nothing was missed, in the regexp definition, should there be a "." after local? should that be regexp="\\x05local.\\x04mesh.\\x01" the full domain is .local.mesh , I am just trying to eliminate any issues.
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 8:01 pm

read my post just above.
 
User avatar
chechito
Forum Guru
Forum Guru
Posts: 2990
Joined: Sun Aug 24, 2014 3:14 am
Location: Bogota Colombia
Contact:

Re: Need help with using an internal DNS

Tue May 01, 2018 8:24 pm



The problem is rather that it is hard to understand from your description what you actually want.


totally agree
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 8:55 pm

Sindy, I tried your method also, but its still not working. Im about ready to just set up another nic in a spare computer and I will remote into that computer when I need to do anything on that network.

chechito Im not sure how to break it down any further. the way the Mesh network operates is a little different, I understand it well because I have been dealing with it for a couple of years. it is just its own private network, no internet, just a large wifi network that is meant for passing files to users on the network. The way the firmware is set up on the my Ubiquiti Rocket that it has a Wifi address of 10.x.x.x, and a NAT address of 192.168.1.200. If I undo the NAT and turn on DHCP on my rocket, this will allow me to access the entire network because the Ubiquiti gear is handling all of the DNS entries. everything on that network has a domain of .local.mesh. so my rocket has an address of KD7VEA-Rocket.local.mesh. If I am directly connected to the rocket with DHCP on, I will get an address for the mesh network, and I can go to any other machine on that network such as KD7VEA-NanoStation.local.mesh or KD7BKO-Rocket.local.mesh.

I leave my Mesh node set to NAT at 192.168.1.200. this allows me me to get to my node, and when I was running my old untangle router, I could point everything ending in .local.mesh to go 192.168.1.200 and then my Mesh node would route me to the other machines on the network.. The simplest way I can describe it is that when I try to point my browser to KD7BKO-Rocket.local.mesh(or anything else on the network that ends in .local.mesh), I need that to direct itself to 192.168.1.200 as the DNS server. I don't know if that made it any more clear?
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 9:09 pm

@sindy: I must insist on my pattern (at least for now, maybe there is some possible improvement). Null byte at the end would be correct, because that's what's in the packet. But RouterOS drops all null bytes from input, before it tries the regexp, and it makes the input quite unpredictable. And if you'd let it end with just "mesh", it would also match hostnames like local.mesh.example.com. So in order to filter out false positives, you need to look for other non-null bytes. Right after hostname are two 16-bit numbers, query type (A, AAAA, ...) and class. First one varies, but luckily most common records are < 256, so that's the "." for any byte. And class is for most uses 1.

@kd7vea: Two things to make sure about:

1) ether2 is the interface where your PC (or whatever device you test it with) is connected to
2) 192.168.1.200 is DNS server that knows how to resolve <anything>.local.mesh

Is so, does the counter for this rule increase? If it does, the problem might be elsewhere. E.g. if you PC would be in same subnet as 192.168.1.200, you'd also need to set up hairpin NAT.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 9:18 pm

yes, the PC is on the same network, and the Hairpin NAT was what I was wondering about from the beginning. I have set up a Hairpin NAT for my webserver. I will look at that and see if I can remember how I set it up and try to translate it for this .local.mesh network.

also, ethernet 2 is what all of my network connects to. ethernet 1 is my WAN side to the Modem, ethernet 2 connects to my switch that hosts everything (computers, servers, wifi, and the Mesh node on 192.168.1.200).
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 9:36 pm

@sindy: I must insist on my pattern (at least for now, maybe there is some possible improvement). Null byte at the end would be correct, because that's what's in the packet. But RouterOS drops all null bytes from input, before it tries the regexp, and it makes the input quite unpredictable. And if you'd let it end with just "mesh", it would also match hostnames like local.mesh.example.com. So in order to filter out false positives, you need to look for other non-null bytes. Right after hostname are two 16-bit numbers, query type (A, AAAA, ...) and class. First one varies, but luckily most common records are < 256, so that's the "." for any byte. And class is for most uses 1.
I have tried while developing my "plaintext" match. You are almost right but the sequence looks as follows:

sales.local.mesh: type A, class IN
    Name: sales.local.mesh
    [Name Length: 16]
    [Label Count: 3]
    Type: A (Host Address) (1)
    Class: IN (0x0001)

which is, in hex representation and in the network (no little-endian here!) format:
05 73 61 6c 65 73 05 6c 6f 63 61 6c 04 6d 65 73 68 00 00 01 00 01
05  s  a  l  e  s 05  l  o  c  a  l 04  m  e  s  h 00
the name terminated by a zero byte
00 01
the record type in big endian
00 01
the class in big endian

The good point is that the
contain
matcher does not remove the null bytes, because a regexp pattern
..\x01
could possibly be too wide.

And yes, I was concentrated on a proper matcher so I've forgotten about the backward path.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 9:42 pm

But the problem is RouterOS eating null bytes, so if packet contains this:
05 73 61 6c 65 73 05 6c 6f 63 61 6c 04 6d 65 73 68 00 00 01 00 01
then L7 matcher works with this:
05 73 61 6c 65 73 05 6c 6f 63 61 6c 04 6d 65 73 68 01 01
And with content="\05local\04mesh\00", there are two problems. First is minor, you have to use CLI to enter this, and non-printable characters will show as garbage in WinBox and WebFig. Another is that this will be case-sensitive (unlike L7 matching), so it can miss some queries.
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 9:57 pm

But the problem is RouterOS eating null bytes, so if packet contains this:
05 73 61 6c 65 73 05 6c 6f 63 61 6c 04 6d 65 73 68 00 00 01 00 01
then L7 matcher works with this:
05 73 61 6c 65 73 05 6c 6f 63 61 6c 04 6d 65 73 68 01 01
And with content="\05local\04mesh\00", there are two problems. First is minor, you have to use CLI to enter this, and non-printable characters will show as garbage in WinBox and WebFig. Another is that this will be case-sensitive (unlike L7 matching), so it can miss some queries.
So your
.\x01
actually means "type any,class in", because each byte in the pattern represents what remains of the 16-bit word after null bytes are removed, OK.
Agreed that my matcher fails on at least one upper case letter and 2^9
contains
rules would probably be equally resource-intensive like
layer7-protocol
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Tue May 01, 2018 10:08 pm

While we're at it, it looks like:
\0x03tld.{2,4}$
should be foolproof way to match everything (all record types and classes) without false positives. RouterOS doesn't like this syntax, so simplied version would be:
\0x03tld...?.?$
But most importantly, none of this would be needed, if MikroTik finally implemented this basic functionality and just allowed users to configure per-domain forwarding like any other decent software allows.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Thu May 03, 2018 6:12 pm


@kd7vea: Two things to make sure about:

1) ether2 is the interface where your PC (or whatever device you test it with) is connected to
2) 192.168.1.200 is DNS server that knows how to resolve <anything>.local.mesh

Is so, does the counter for this rule increase? If it does, the problem might be elsewhere. E.g. if you PC would be in same subnet as 192.168.1.200, you'd also need to set up hairpin NAT.
I had some time to work on this again, and yes, the new NAT rule counter does increase when when I attempt to navigate to an address on the Mesh network, but the Hairpin counter does not increase. I tried to use the hairpin settings I used for my webserver and modify them for the mesh connection at 192.168.1.200, but I'm not totally sure I am doing it correctly. so it seems like the rule is sending it correctly, but the issue may be on the hairpin. I am only using 2 ports on my MikroTik, would it make sense to move my Mesh device that is 192.168.1.200 off of my main network, and place it on Port 3 of the MikroTik and eliminate the hairpin all together, or am I making things more complicated? I could set it back to its default 10.x.x.x address and to not have conflicts with my home subnet.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Thu May 03, 2018 7:02 pm

Post a little bit more about your config, at least the non-working hairpin NAT rule and we'll (most likely) find some solution, without need to change everything.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Thu May 03, 2018 10:53 pm

Sob, I did not see this message until I had already reconfigured. It only takes me a minute to move these around, so i figured this could be the easiest way to see if it works without the Hairpin (I think) if I need to change it back I can. so the way it is set up now, My secondary network that I am trying to brows(the .local.mesh network) is now on ethernet 3 on the Mikrotik. I also change the DHCP configuration so now it is not NATed to my network, it has an IP address of 10.18.199.45 the subnet is 255.255.255.252. I tried to make a nat rule to send the .local.mesh traffic to port 3, but I assume I have not got that set up correctly. I used the code that you had already posted.

/ip firewall layer7-protocol
add name="dns for local.mesh" regexp="\\x05local\\x04mesh.\\x01"
/ip firewall nat
add action=dst-nat chain=dstnat protocol=udp dst-port=53 in-interface=ether3 layer7-protocol="dns for local.mesh" to-addresses=10.18.199.45

do I need to also set up a Masquerade for that network? or is there something elsewhere that I could be overlooking?
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Fri May 04, 2018 12:05 am

In dstnat rule, in-interface=ether3 must be where the client device that sends query for something.local.mesh is connected to. From your description I'm not sure if it is or not.

If DNS server (10.18.199.45) has correct route back to client subnet (192.168.1.x), you don't need masquerade. But it it doesn't, you need it.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Fri May 04, 2018 12:27 am

Okay, my cllient Machine and all other devices are on ethernet 2, my modem is on ethernet 1, I put the .local.mesh network on ethernet 3. so it sounds like i need to move it back to ethernet 2 reconfigure the Nat rule for ethernet 2, and change the IP back to the NAT address. at that point I will try the Hairpin again and post my configuration. thanks for sticking with me through this nightmare.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Fri May 04, 2018 12:56 am

Easy, just understand what each part does and it should be really simple.

Dstnat rule inspects packets with DNS queries coming from client device, and going to any DNS resolver. If L7 matches (i.e. the query is for anything.local.mesh), it changes destination to server that knows the answer. The packet gets routed there, server sends response back (it must know where) and that's it.

So just using in-interface=ether2 in dstnat rule might be enough.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Fri May 04, 2018 7:52 pm

Based off of a previous post about seeing if the counters increment, I decided to do some testing. I have my web server on this same network, so I looked at the NAT rules for it and copied and modified them so that if you go to my public IP of 160.7.249.40:8080, you should see the local mesh node that is connected, but i cant even get to that webpage, so this tells me that it could be part of my overall problem. The mesh node runs a web server on port 8080 for setting up the node, and and some tools that show everybody else on the network. I also thought that if you could see the interface that I am working with, maybe it could make a little more sense.as to how this works and what I'm doing with it. The 2 rules on my web server NAT, when I go to my website (not on the Mesh node, but to my main web server) I see both counters increase. the first rule is a DSTNAT that sends port 80 of my public IP to my web server,
This rule increments the counter from inside or outside of my network
Chain dstnat
Dst. Address 160.7.249.40
Protocol 6 (tcp)
Dst. Port 80
Action dst-nat
To Addresses 192.168.1.86

This rule will increment the counter from inside my network
the second rule is an SRCNAT
Chain srcnat
Src. Address 192.168.1.0/24
Dst. Address 192.168.1.86
Protocol 6 (tcp)
Dst. Port 80
Out. Interface ether2
those are for my web server

I created rules for the web server on my node that runs on port 8080 from the actual Ubiquiti device but I only see the DSTNAT rule increase, the SRC rule count stays at zero
here are the rules

this rule will increase every time I try to get to my Mesh node web page from inside or outside of my network,
Chain dstnat
Dst. Address 160.7.249.40
Protocol 6 (tcp)
Dst. Port 8080
Action dst-nat
To Addresses 192.168.1.200
To Ports 8080

this rule stays at zero on the counter both inside and outside of the network
Chain srcnat
Src. Address 192.168.1.0/24
Dst. Address 192.168.1.200
Protocol 6 (tcp)
Dst. Port 8080
Out. Interface ether2
Action masquerade
To Ports 8080

I don't know what to think of this. I feel like if I can get this issue figured out, I will be one step closer to getting the bigger issue figured out. any ides?
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Fri May 04, 2018 9:12 pm

Check rules in /ip firewall filter, chain=forward.

When I look at the rules you posted, I don't see any other difference than destination address and port. So if one set works, the other must work too. If not, it might be because router can't communicate with 192.168.1.200 (can you ping it from router?) or the connection is blocked by firewall.

Edit: The question about ping if of course stupid, it must be accessible when it's possible to connect from outside.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Sat May 05, 2018 1:33 am

Okay, I got the issue of port forwarding my node to the internet. My gateway setting got unchecked on that mesh node. so I set it back to my default gateway. You can now look access the node main pages from the internet, but you cant browse the network from there (that would be kind of cool for showing the capabilities of the system to people) but you can get to the Mesh status page where you can see all of the other systems connected, and the services on the network like the PBX, FTP servers and so on. If you go to 160.7.249.40:8080 and click on Mesh Status, this may give you a little better idea of what I am working with. all of the red links are either other nodes that I can brows to, or under services column, these are services that have been added to the network, and I can click on those and brows to those(When I am directly connected to My ubiquiti rocket.

so now, I know that the port forwarding and Hairpin NAT should be working correctly, so now I just need to focus on the initial issue of being able to browse the network.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Sat May 05, 2018 1:58 am

I don't know if it's intentional, but I can no longer access the server on port 80 from outside. The one on 8080 works.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Sat May 05, 2018 2:04 am

My UPS went off line at home, everything came back online but the main webserver did not. it will be back up in about 10 minutes when I get home.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Tue May 08, 2018 12:18 am

I did a little more testing this weekend, but still havent got it working. I believe the hairpin is working correctly because I can acces my Mesh node from inside my network, and also at 160.7.249.40:8080. I did start wondering because the nodes themselves run the webpages on port 8080, but I don't believe any other machines on the network do, like the Email server, and samba server. but from what I understand from one of the Previous posts, the Layer 7 protocol can handle that even if that is the case.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Tue May 08, 2018 12:32 am

Try to expand "not working" a little more.

So far we were dealing with DNS queries, that's what L7 filter was for. Does this part work now, i.e. if from your PC you try e.g. "ping <something>.local.mesh", does it resolve the hostname correctly? If not, can you resolve it, when you ask the mesh-aware DNS server directly (in Windows you can use "nslookup <something>.local.mesh 192.168.1.200")?

If DNS works, routing will need few more touches. First your router must know route to mesh network:
/ip route
add dst-address=10.0.0.0/8 gateway=192.168.1.200
And since other mesh nodes are unlikely to know (correct me is I'm wrong) where your 192.168.1.0/24 is, you'll also need NAT masquerade on your mesh mode, so all connections from 192.168.1.0/24 will look like they come from your node's 10.x.x.x address an d replies will come back correctly.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Tue May 08, 2018 7:36 am

port forwarding the nodes web server works, that was part of making sure the hair pin was working properly. The initial issue of trying to access devices on the .local.mesh network is still not working(The original issue, and the one that really matters) so I am going through your steps and here is what I am getting. I ran NSLookup and here is what I got.
nslookup N0KVN-Sector120.local.mesh 192.168.1.200
Servers: localnode.local.mesh
address: 192.168.1.200
DNS request timed out.
timeout was 2 seconds.
name: N0KVN-Sector120.local.mesh
address: 10.64.211.225

I then added the static route, and now I can ping the IP address of other nodes, and I can navigate to the nodes Be browsing to the IP address of the nodes.this is progress, its not the optimal method, but it does show that you are on the right path. there is just something in the DNS somewhere that isn't working as it should.

as for the issue you questioned about other nodes being able to see mine on with the NAT address, those node only see my WAN address that is tied to the wireless, so the entire network infrastructure is based on wieless, that address is unchanged. in the configuration of my mesh node, I do any port forwarding I need to allow devices on my network out on to the Mesh network, so unless I am overlooking something, the Mikrotik shouldn't have to handle any of the routing for other devices on the WAN side looking in.

so in short, the Static route now lets me brows the network by IP, but I still cant browse by name.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Tue May 08, 2018 9:06 am

UPDATE
It is now fully working. The Static route was the Key. I had already setup a static, route but it wasn't set up correctly. I followed the static route setup that was Posted by Sob, and then changed my primary DNS to 192.168.1.200, and secondary to 8.8.8.8. The connection is a little slow, but I'm not sure if that is related to the wireless connections or something in the routing. I will do some more testing tomorrow, but at least it works. Thanks for all of the help Sob, I am so happy to finally have this running.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Tue May 08, 2018 11:10 pm

Wait a little with celebration. You can't combine internal and external DNS resolvers like this. It might appear to work, but you'll experience seemingly random failures in future. Even though DNS resolvers are sometimes referred to as primary and secondary, they are supposed to be equal. There's no guarantee that primary will be always asked first. And I don't need to explain what will happen, if question for something.local.mesh goes to 8.8.8.8. Well, maybe I should. There won't be any positive answer, this part is clear. But the negative answer won't be "I don't know, ask elsewhere", it will be "this domain does not exist". And if it's clearly said that it doesn't exist, client won't ask another resolver and resolution will fail.

So one step back, we know that 192.168.1.200 is willing to answer DNS queries sent from your PC. We can assume that it will also work when source address will belong to router, because it's in same subnet. Put back the original DNS config, enable dstnat rule for DNS with L7 filter and corresponding srcnat rule for hairpin NAT. Then try "nslookup N0KVN-Sector120.local.mesh" without specifying used server (it will use some from system config). Does this work? If not, post your NAT rules here.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Wed May 09, 2018 7:36 am

so with everything set and my DNS servers set at 8.8.8.8 and 1.1.1.1, the NSLookup times out. I knew there were still some other issue because it is a little slow when browsing the Mesh network and I assumed it is due to the configuration. here is my NAT configuration.

Chain dstnat
Protocol 17 (udp)
Dst. Port 53
In. Interface ethernet 2
Layer7 Protocol dns for local.mesh
Action dst-nat
To Addresses 192.168.1.200


Chain dstnat
Dst. Address 160.7.249.40
Protocol 6 (tcp)
Dst. Port 8080
Action dst-nat
to-address 192.168.1.200



Chain srcnat
Src. Address 192.168.1.0/24
Dst. Address 192.168.1.200
Protocol 6 (tcp)
Dst. Port 8080
Out. Interface ether 2
Action Masquerade
To Ports 8080
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Wed May 09, 2018 5:55 pm

If this is all, then you're clearly missing hairpin NAT rule (srcnat) for DNS. It would be the same as for web, only with udp/53 instead of tcp/8080. Or you can use common one without protocol and port.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Wed May 09, 2018 10:41 pm

I know I had that NAT rule at some point, I think I got rid of it somewhere along the line by accident. It is now working with google DNS settings in the Router. It is still a little slow, but that may be on the wireless side, I will have to look into that.
 
User avatar
Bergante
Member Candidate
Member Candidate
Posts: 144
Joined: Tue Feb 28, 2012 12:27 pm
Location: Bilbao, Spain

Re: Need help with using an internal DNS

Thu May 10, 2018 9:18 am

For DNS, always use both TCP and UDP. Nowadays some applications are making large queries and, depending on the support for EDNS (large responses over UDP) you will need TCP.

In order to make this work without hiccups you really need your own DNS server. You should configure it with a forward type zone, so that queries for mesh.local will be forwarded to the right server, and default forwarders for the rest, pointing to the public DNS servers you wish to use, like 8.8.8.8, 1.1.1.1, 9.9.9.9 or your ISP's servers.

If using bind, the syntax for a forward zone is (example):
zone "subzone.mydns.example.com" {
  type forward;
  forwarders { 192.168.0.4; };
};
Probably you can also use a different (and simpler to configure) DNS server like unbound but you must investigate a bit. Unbound has an advantage: if you use
the 1.1.1.1 public DNS server you can use the new encrypted DNS protocol so that your ISP won't be able to incercept nor monitor your DNS queries (some have done that in the past).


73, EA2EKH
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Thu May 10, 2018 8:58 pm

thanks for the info Bergante, this has been a learning experience, but that was part of the plan in switching over to the MikroTik router. I will assume that by running my own DNS, it should speed up the MESH network browsing. It is quite a bit slower than if I connect directly to it, so I will look into setting up a DHCP server. I think i still have a few Raspberry PI's laying around, I don't think there is a need for another big server???
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Thu May 10, 2018 9:12 pm

The slowness shouldn't be because of DNS. Address resolution happens only at the beginning, connections work further with IP addresses. And results are cached, so another connection to same address few seconds, minutes or even hours later (depends on TTL) does not need to repeat DNS resolution. And delay caused by routing the query through router will be something like a millisecond anyway. But I can't say what else it could be.

RasPi is powerful enough for being DNS server, and you have more than one resolver software to choose from. Main problem is that it's another machine. And if you make it your main DNS resolver, it becomes single point of failure. You can add another, but then it may become a little too complicated for given purpose.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Thu May 10, 2018 10:07 pm

if setting up my own DNS wont change the speed, I probably wont tackle that job right now. I will do some trace routes tonight and see whats going on with it.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Thu May 10, 2018 10:58 pm

Can 192.168.1.200 resolve only <something>.local.mesh or everything? If it would be everything, you can do simple test by setting 192.168.1.200 as the only DNS resolver for your PC. Even if it could do only local.mesh, you can still try it, to see if it makes any diffence for accessing servers under local.mesh. Only in this case, you'd lose access to everything else while doing the test.
 
User avatar
Bergante
Member Candidate
Member Candidate
Posts: 144
Joined: Tue Feb 28, 2012 12:27 pm
Location: Bilbao, Spain

Re: Need help with using an internal DNS

Fri May 11, 2018 11:57 am

A misconfigured DNS server can really be a problem. It's difficult to say what's wrong without diagnosing it on site, though.

There is a simple test you can perform.

What happens if you configure your computer to use *just* a valid, public DNS server (8.8.8.8, or 9.9.9.9)? (I am not mentioning 1.1.1.1 for now because it's known to be unreachable from many ISPs.

If it works better then it's a DNS problem.

And regarding configuration, the right way to do it if you want access to your mesh.local domains *and* the public Internet you really need a properly configured DNS server of your own. A Raspberry will do fine, you don't need a lot of performance. Just the right configuration! :)
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Sat May 12, 2018 12:52 am

Okay, I plan on doing some more testing this weekend, because I thought at first that I could live with the speeds, but it really is bad. I was trying to add a mail server on my network over to the Mesh network, and I gave up after a while just because it was too slow to function. It takes around 20 seconds or more to open any pages past my NAT node of 192.168.1.200, so I will directly connect my node this weekend to be sure that speeds are still good if I bypass the router.
 
kd7vea
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 99
Joined: Fri Dec 08, 2017 7:52 pm

Re: Need help with using an internal DNS

Mon May 14, 2018 5:13 pm

I did a little bit of testing here this weekend, we had a huge lightning storm and we think our mountain top site may have been hit, so we have spent most of our weekend rounding up part to go up and try to get it online. I did get a chance to test using only the 192.168.1.200 as the DNS for everything, and it does work, but it is no faster. I don't know if this will shed any light on the subject or not, but when I am using my VPN connection from my office, I can access 192.168.1.200, but if I try to go past that node to anything else, I get nothing. no other pages will load. Like I said, maybe that will shed some more light on the other issue, but if not, just disregard.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: Need help with using an internal DNS

Mon May 14, 2018 6:01 pm

I guess you may be missing route to 10.x.x.x from VPN. Or VPN client can have IP address from some other subnet and the gateway device (192.168.1.200) refuses to let it pass, or doesn't do srcnat for it (target devices wouldn't know where to send replies).
 
User avatar
Bergante
Member Candidate
Member Candidate
Posts: 144
Joined: Tue Feb 28, 2012 12:27 pm
Location: Bilbao, Spain

Re: Need help with using an internal DNS

Mon May 14, 2018 6:16 pm

Anyway try running the test linked from this website:

https://www.dns-oarc.net/oarc/services/cmdns

It may shed some light on DNS server problems.

Who is online

Users browsing this forum: Ahrefs [Bot], Amazon [Bot], Energizer, Google [Bot], sgiglio, straightslant and 97 guests