Community discussions

MikroTik App
 
ZeeKay
newbie
Topic Author
Posts: 43
Joined: Wed Feb 06, 2019 4:08 am

How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 5:26 pm

Hello,

I've setup Pihole on another device. And I have NATted the DNS for all my local networks using the technique shown in this video (https://www.youtube.com/watch?v=EdzDCkFaskc). This is all working great so far.

I have some local domains for my home network that I cannot use anymore as a result of this change. These are just local domains and hostnames and have nothing to do with any domain registry. In fact, they only exist within the Mikrotik static DNS table. This behavior is expected as Pihole does not recognize them and its not my DHCP Server. My Mikrotik router is the DHCP server.

How do I configure either:
  • Mikrotik router to not DNS NAT local domain/host names (there are a few)? Or
  • Pihole to forward resolution of these domains to Mikrotik router instead of upstream DNS?
Thanks
ZeeKay

UPDATE: I've posted my question in another forum for help. Here's the text of my question, which could be clearer that the original one I posted
The issue I am facing:
I cannot lookup hostnames on my local network when I use Pi-Hole as my DNS. I can reach them via their IPs, but hostnames with local domain names (like .home, .lab etc) does not work anymore.

Details about my system:
I am running Pi-Hole on RPi. Versions are:

Pi-hole [v5.14.2]
FTL [v5.20]
Web Interface[v5.18]

I have a router that supports multiple VLANs and my network is segmented into 4 VLANs. Pi-Hole lives within one VLAN and is accessible to other VLANs via proper routing rules in place. Pi-Hole is also setup with DoH with Cloudflare and DNSSEC.

Router is the DHCP server and I'd like to keep it that way as it allocates IPs for various subnets across multiple VLANs. Router also maintains its own DNS list for local network.

What I have changed since installing Pi-hole:
Before introducing Pi-Hole, the router was the DNS. It resolved local network domains and hostnames via its own local DNS list that it maintains (its dynamic and keeps track of which hosts are connected at any given time). It also forwarded DNS requests to external DNS that I configured.

Now that Pi-Hole is the default DNS across all VLANs, I can see the traffic, the dashboard, who is doing what. But I cannot use local hostnames with local domain names anymore. I'd like to be able to use my local network names again.

How can I tell Pi-Hole to forward DNS requests for specific domain names to my router, instead of Cloudflare?

Thanks in advance!
Last edited by ZeeKay on Wed Jan 11, 2023 2:43 am, edited 1 time in total.
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 12001
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:08 pm

add static entries inside pihole
 
ZeeKay
newbie
Topic Author
Posts: 43
Joined: Wed Feb 06, 2019 4:08 am

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:13 pm

add static entries inside pihole
Mikrotik assigns IPs to hostnames randomly. Dont want to hardcode them.
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 12001
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:15 pm

And inside the MikroTik device, how is managed to bind DNSs with IPs?
Are not already hardcoded? «only exist within the Mikrotik static DNS table»
 
ZeeKay
newbie
Topic Author
Posts: 43
Joined: Wed Feb 06, 2019 4:08 am

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:19 pm

And inside the MikroTik device, how is managed to bind DNSs with IPs?
Are not already hardcoded? «only exist within the Mikrotik static DNS table»
I've written a script that gets executed every time a DHCP server assigns a new IP address. The script puts an entry into the static DNS table. The script also cleans up previous entries in the DNS table.
 
optio
Long time Member
Long time Member
Posts: 672
Joined: Mon Dec 26, 2022 2:57 pm

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:27 pm

You can put these hosts into firewall address lists, and then in nat rule you can exclude them. Address lists supports dns resolving (add hostname instead ip into Address field) and it creates dynamic address list with resolved ip of host.
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 12001
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:29 pm

And what does it have to do with it? That's not what was requested.
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 12001
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:31 pm

@ZeeKay
I'll stop here, I don't know how pihole works, but probably if you make it also the DHCP server can automatically add the fqdn.
 
optio
Long time Member
Long time Member
Posts: 672
Joined: Mon Dec 26, 2022 2:57 pm

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:34 pm

True, did not read carefully... In my setup, I'm running PiHole in ROS container, PiHole uses ROS DNS server as upstream server and in that way it can resolve local lan hosts.
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 12001
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:39 pm

Then:

PC has pihole DNS, pihole has RouterOS DNS, then RouterOS use public DNS?
 
optio
Long time Member
Long time Member
Posts: 672
Joined: Mon Dec 26, 2022 2:57 pm

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:41 pm

Then:

PC has pihole DNS, pihole has RouterOS DNS, then RouterOS use public DNS?
Yes
 
ZeeKay
newbie
Topic Author
Posts: 43
Joined: Wed Feb 06, 2019 4:08 am

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:54 pm

You can put these hosts into firewall address lists, and then in nat rule you can exclude them. Address lists supports dns resolving (add hostname instead ip into Address field) and it creates dynamic address list with resolved ip of host.
I thought about that and wasnt sure if this will work. Another data point is that I have VLANs for each of my internal networks, so I was wondering if I can write a DNS NAT rule such that if the destination IP is within recognized VLANs then do not NAT the DNS.
 
ZeeKay
newbie
Topic Author
Posts: 43
Joined: Wed Feb 06, 2019 4:08 am

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 6:55 pm

@ZeeKay
I'll stop here, I don't know how pihole works, but probably if you make it also the DHCP server can automatically add the fqdn.

I want to continue to use my MK router as DHCP because I have VLANs created and each VLAN has its on DHCP. Love ROS.
 
optio
Long time Member
Long time Member
Posts: 672
Joined: Mon Dec 26, 2022 2:57 pm

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 7:05 pm

You can put these hosts into firewall address lists, and then in nat rule you can exclude them. Address lists supports dns resolving (add hostname instead ip into Address field) and it creates dynamic address list with resolved ip of host.
I thought about that and wasnt sure if this will work. Another data point is that I have VLANs for each of my internal networks, so I was wondering if I can write a DNS NAT rule such that if the destination IP is within recognized VLANs then do not NAT the DNS.
It can be done with address lists as I mentioned in my first reply, I knew you will needed this at some point :)
Last edited by optio on Tue Jan 10, 2023 7:05 pm, edited 1 time in total.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19322
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: How to exclude certain domains from DNS NAT?

Tue Jan 10, 2023 7:05 pm

Some day the Italian cat will realize that getting a full appreciation of the requirements prior to advising config is the short path to success! ;-)
Often the OP is unable to articulate the requirements due to mixing them in with config speak.......
One thing is to understand the context of the physical or intended network design, separately the requirements stand on their own merit.
OR
Some like torture. :-)
 
ZeeKay
newbie
Topic Author
Posts: 43
Joined: Wed Feb 06, 2019 4:08 am

Re: How to exclude certain domains from DNS NAT?

Wed Jan 11, 2023 12:45 am



I thought about that and wasnt sure if this will work. Another data point is that I have VLANs for each of my internal networks, so I was wondering if I can write a DNS NAT rule such that if the destination IP is within recognized VLANs then do not NAT the DNS.
It can be done with address lists as I mentioned in my first reply, I knew you will needed this at some point :)

Can you elaborate on the specifics. I have a VLAN identifier and each VLAN has its own as well. So I believe I can filter based on that. Regardless, what will the DNS NAT rule need to look like?
 
optio
Long time Member
Long time Member
Posts: 672
Joined: Mon Dec 26, 2022 2:57 pm

Re: How to exclude certain domains from DNS NAT?

Wed Jan 11, 2023 9:41 pm



It can be done with address lists as I mentioned in my first reply, I knew you will needed this at some point :)

Can you elaborate on the specifics. I have a VLAN identifier and each VLAN has its own as well. So I believe I can filter based on that. Regardless, what will the DNS NAT rule need to look like?
Simply using Winbox/Webfig create address list for each VLAN netmask/ip range with same name, eg. VLAN. Edit nat rule and set in Src. Address List that name with exclamation mark check in the box to exclude all these addreses from list and rule will not apply for them.
 
ZeeKay
newbie
Topic Author
Posts: 43
Joined: Wed Feb 06, 2019 4:08 am

Re: How to exclude certain domains from DNS NAT?  [SOLVED]

Thu Jan 12, 2023 6:57 pm

I finally found a solution to this and it is working now.

Basically, I had to tell pihole to go my my MK router for any local domains I have. This required creating a custom config for dnsmasq as follows:

This can be done using a user-specific dnsmasq configuration file.

Before you set this, you should check whether your Mikrotik router even answers local DNS queries by sending corresponding DNS queries to the router IP, e.g.

nslookup <local-name> <router.ip>
nslookup <local-ip> <router.ip>

where you replace the values in brackets (<>) appropriately. Your router should answer both requests correctly.

If your router delivers the answers correctly, you can create e.g. /etc/dnsmasq.d/42-my-vlan-forwarding.conf:

rev-server=<vlan-range/CIDR>,<server.ip>
server=/<vlan.domain>/<server.ip>

where you replace <vlan-range/CIDR>, <vlan.domain> and <server.ip> with the required values.

Then check for syntactical errors:
pihole-FTL dnsmasq test

If OK, Pi-hole can be restarted:
pihole restartdns

Who is online

Users browsing this forum: artur3, GoogleOther [Bot], rudivd and 87 guests