Can't add my own DNS server

shadow82 · Wed Jul 27, 2022 10:36 pm

Hi!
Just started fun with MKT by using RB4011
Simple stuff - I have LAN of 192.168.1.0/24 with DHCP server and within that I have already implemented firewall that works mostly as DNS server (for now).
Simple thing to use but it doesn't work.

The question is: how to add my own internal DNS server to my RB4011?
Shouldn't it be put here?

Or from CLI:

[admin@RB4011.home] > /ip dns print
                      servers: 192.168.1.5
              dynamic-servers: 194.204.159.1,194.204.152.34
               use-doh-server: 
              verify-doh-cert: no
        allow-remote-requests: yes
          max-udp-packet-size: 4096
         query-server-timeout: 2s
          query-total-timeout: 10s
       max-concurrent-queries: 100
  max-concurrent-tcp-sessions: 20
                   cache-size: 2048KiB
                cache-max-ttl: 1w
                   cache-used: 237KiB

Simple as that, right?
Yet it doesn't resolve internal names until I point it out manualy:

[admin@RB4011.home] > put [:resolve gns3-vm.home]
failure: dns name does not exist
[admin@RB4011.home] > put [:resolve gns3-vm.home server=192.168.1.5]
192.168.1.8

My DHCP clients do get 192.168.1.1 (MKT) and 192.168.1.5 (DNS), yet they also don't recognize internal names...

mkx · Wed Jul 27, 2022 10:46 pm

Get rid of those dynamic servers ... those don't know anything about your internal DNS hierarchy. DNS clients don't prioritize any of servers, those are used in a pseudo-round-robin fashion: clients start using certain server and use it until connection fails and then turn to use next DNS server. Mind that negative answer (i.e. name does not exist) doesn't count as connection failure.

washdogg87 · Thu Jul 28, 2022 8:56 pm

In your DHCP client settings, you need to uncheck "Use Peer DNS". This will remove the Dynamic Servers and start picking up the DNS addresses you've configured.

See >> https://wiki.mikrotik.com/wiki/Manual:I ... Properties

You might also want to add another DNS server like 1.1.1.1 as a fallback in case your local DNS goes down.

mkx · Thu Jul 28, 2022 9:49 pm

You might also want to add another DNS server like 1.1.1.1 as a fallback in case your local DNS goes down.

No. This would bring back the problems OP is having right now. In DNS there's no such thing as primary or backup server. All configured servers are used equally and clients expect that all configured servers return equal replies.

So when one starts using non-public domains, use of public servers is a huge no-no. If one heavily relies on DNS, then one has to run two internal DNS servers (for domain they're authoritative servers they are configured in master-slave configuration, but this only applies to DNS records management, changes are always propagated from master to slave(s)) and instruct (via DHCP) clients to use those two.

Can't add my own DNS server

Can't add my own DNS server

Re: Can't add my own DNS server

Re: Can't add my own DNS server

Re: Can't add my own DNS server

Who is online