Community discussions

MikroTik App
 
User avatar
tplecko
Member Candidate
Member Candidate
Topic Author
Posts: 120
Joined: Mon Jun 11, 2007 12:18 pm
Location: Croatia
Contact:

v6.49 wrong input firewall rule order execution

Sun Oct 24, 2021 12:19 am

When having rules:
add action=accept chain=input comment="Allow A.B.C.D" log=yes src-address=A.B.C.D
add action=drop chain=input comment="Drop all" disabled=yes in-interface=internet

router cannot resolve DNS (located at the A.B.C.D address):
resolve domain-name="fqdn" server=A.B.C.D

in fact, no resolving works when the second rule is active.
 
User avatar
bpwl
Forum Guru
Forum Guru
Posts: 2983
Joined: Mon Apr 08, 2019 1:16 am

Re: v6.49 wrong input firewall rule order execution

Sun Oct 24, 2021 12:47 am

This is an outgoing DNS request, not a traffic initiated by the A.B.C.D server.
You should allow the answer for that established outgoing session.
See the default first rule : "defconf: accept established,related,untracked"
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
There is no need to accept input from server A.B.C.D for those DNS queries. (Better close that door ?)
 
User avatar
tplecko
Member Candidate
Member Candidate
Topic Author
Posts: 120
Joined: Mon Jun 11, 2007 12:18 pm
Location: Croatia
Contact:

Re: v6.49 wrong input firewall rule order execution

Sun Oct 24, 2021 11:50 am

Thanks.
Works now.

I didn't expect that this would have to be explicitly set.

Who is online

Users browsing this forum: anav, Bing [Bot], infabo, JesusUve, kolopeter, menyarito, Michiganbroadband and 82 guests