Community discussions

MikroTik App
 
patrickmkt
Member Candidate
Member Candidate
Topic Author
Posts: 200
Joined: Sat Jul 28, 2012 5:21 pm

DNS resolve and address list

Sun Jul 23, 2017 8:27 am

I have multiple firewall rules based on address-list filters.
My address lists are updated regularly by the standard script that resolve the hostname to an ip:
:local comment
:local newip
:local oldip

# Loop through each entry in the address list.
:foreach i in=[/ip firewall address-list find] do={

# Get the first five characters of the list name
  :set list [:pick [/ip firewall address-list get $i list] 0 5]

# If they're 'host_', then we've got a match - process it
  :if ($list = "host_") do={

# Get the comment for this address list item (this is the host name to use)
    :set comment [/ip firewall address-list get $i comment]
    :set oldip [/ip firewall address-list get $i address]

# Resolve it and set the address list entry accordingly.
     :do {:set newip [:resolve $comment];} on-error {set newip $oldip};
    : if ($newip != $oldip) do={ /ip firewall address-list set $i address=$newip }
    }
  }
However, I have recently noticed that some of my hostnames are not resolved properly.
This happens only for two hostnames that are present in multiple address lists. It is resolved properly for the few first instances but then not anymore on the following.

That is leading me to the following questions:
- is the resolve command sending the request to the outside dns everytime or is it using the mikrotik dns cache for the next ones if the ttl delay is not expired?
- would some dns server refuse to reply after being queried too many time for the same host within a short time frame?

Thanks
 
msatter
Forum Guru
Forum Guru
Posts: 2912
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: DNS resolve and address list

Sun Jul 23, 2017 11:26 am

Cache as long the TTL is not expired is the normal procedure otherwise why would you have a cache.

You could flush the cache each time you run that script or even for each iteration of a domain-name.
/ip dns cache flush
 
pe1chl
Forum Guru
Forum Guru
Posts: 10240
Joined: Mon Jun 08, 2015 12:09 pm

Re: DNS resolve and address list

Sun Jul 23, 2017 12:06 pm

I have multiple firewall rules based on address-list filters.
My address lists are updated regularly by the standard script that resolve the hostname to an ip
Why so difficult? Just put the hostname in the address field and the router resolves it automatically and
at the correct frequency (TTL of the DNS record). No need for a script.
 
patrickmkt
Member Candidate
Member Candidate
Topic Author
Posts: 200
Joined: Sat Jul 28, 2012 5:21 pm

Re: DNS resolve and address list

Sun Jul 23, 2017 1:01 pm

Why so difficult? Just put the hostname in the address field and the router resolves it automatically and
at the correct frequency (TTL of the DNS record). No need for a script.
First of all, the automatic resolving of hostname is quite recent in the functionnalities of ROS.
Second, some of the hostname are dyndns with a 60s TTL. I don't want to have the router resolve these addresses every 60s for the routing filter. A once per hour resolve is good enough for my needs.

But what I don't understand is why this script that was working for years, is now recently causing trouble with too many resolve of the same hostname.
 
pe1chl
Forum Guru
Forum Guru
Posts: 10240
Joined: Mon Jun 08, 2015 12:09 pm

Re: DNS resolve and address list

Sun Jul 23, 2017 1:15 pm

I don't think there is a problem with too many resolves.
There is lots of software around that does not cache at all and does the same DNS query multiple times per second.
 
rftnon
newbie
Posts: 29
Joined: Fri Feb 28, 2014 6:34 pm

Re: DNS resolve and address list

Mon Jul 24, 2017 10:55 am

I also have the same problem
you are right
He was previously working for a long time
But after recent updates, this problem appeared

please ... help me ...
 
pe1chl
Forum Guru
Forum Guru
Posts: 10240
Joined: Mon Jun 08, 2015 12:09 pm

Re: DNS resolve and address list

Mon Jul 24, 2017 11:43 am

I suggest that you use the standard function of putting a DNS name in an address list item and not worry about 1 packet per minute.
 
rftnon
newbie
Posts: 29
Joined: Fri Feb 28, 2014 6:34 pm

Re: DNS resolve and address list

Mon Jul 24, 2017 12:12 pm

Thank you pe1chl

please ... Possible illustrative example ?

Who is online

Users browsing this forum: No registered users and 39 guests