Community discussions

MikroTik App
  4. RouterOS
  5. Beginner Basics

Hide upstream DNS name server from clients  [SOLVED]

Post Reply
 
derolf
just joined
Topic Author
Posts: 7
Joined: Sat Apr 13, 2024 6:29 pm

Hide upstream DNS name server from clients

Wed Apr 17, 2024 11:07 am

Running
Code: Select all
scutil --dns
on my Mac shows:
Code: Select all
resolver #1
  nameserver[0] : 192.168.178.1
  nameserver[1] : 1.1.1.1
  if_index : 15 (en0)
  flags    : Request A records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)
So my HEX is disclosing its upstream DNS name server. Is it possible to hide that from the clients and let only the HEX resolve all DNS?

Config:
Code: Select all
[admin@MikroTik] /ip/dns> export 
# 2024-04-17 10:06:46 by RouterOS 7.14.2
# software id = WX80-GBN0
#
# model = RB750Gr3
# serial number = HFK09EZD06Y
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip dns static
add address=192.168.178.1 comment=defconf name=router.lan
Top
 
CGGXANNX
Frequent Visitor
Frequent Visitor
Posts: 74
Joined: Thu Dec 21, 2023 6:45 pm

Re: Hide upstream DNS name server from clients

Wed Apr 17, 2024 11:13 am

You can explicitly specify the list of DNS servers (in this case, just 192.168.178.1) that the DHCP clients will use in the corresponding /ip dhcp-server network entry.
Last edited by CGGXANNX on Wed Apr 17, 2024 11:15 am, edited 1 time in total.
Top
 
ips
Frequent Visitor
Frequent Visitor
Posts: 86
Joined: Mon Oct 09, 2023 6:48 pm
Location: Italy

Re: Hide upstream DNS name server from clients

Wed Apr 17, 2024 11:14 am

That's strange. What is the configuration of the DHCP server?
Top
 
User avatar
vingjfg
Member
Member
Posts: 331
Joined: Fri Oct 20, 2023 1:45 pm

Re: Hide upstream DNS name server from clients

Wed Apr 17, 2024 11:16 am

Can you check that this DNS is not configured as an option in your DHCP?
Code: Select all
> /ip/dhcp-server/network/export
...
/ip dhcp-server network
add address=192.168.2.0/24 dns-server=192.168.2.1 gateway=192.168.2.1 netmask=24
Top
 
derolf
just joined
Topic Author
Posts: 7
Joined: Sat Apr 13, 2024 6:29 pm

Re: Hide upstream DNS name server from clients

Wed Apr 17, 2024 11:37 am

Code: Select all
[admin@MikroTik] > /ip/dhcp-server/network/export 
...
/ip dhcp-server network
add address=0.0.0.0/24 comment=defconf dns-server=192.168.178.1 gateway=0.0.0.0 netmask=24
add address=192.168.178.0/24 gateway=192.168.178.1 netmask=24
[admin@MikroTik] >
Top
 
CGGXANNX
Frequent Visitor
Frequent Visitor
Posts: 74
Joined: Thu Dec 21, 2023 6:45 pm

Re: Hide upstream DNS name server from clients  [SOLVED]

Wed Apr 17, 2024 11:39 am

You should remove the 1st entry with 0.0.0.0/24 and add dns-server=192.168.178.1 to the 2nd entry (in WinBox just enter that address in the DNS textbox).
Top
 
User avatar
vingjfg
Member
Member
Posts: 331
Joined: Fri Oct 20, 2023 1:45 pm

Re: Hide upstream DNS name server from clients

Wed Apr 17, 2024 11:41 am

Interesting. Let me fire up my old mac to see what scutil says.
Top
 
User avatar
vingjfg
Member
Member
Posts: 331
Joined: Fri Oct 20, 2023 1:45 pm

Re: Hide upstream DNS name server from clients

Wed Apr 17, 2024 11:54 am

Nope, I only see the local DNS resolver and not its upstream.
Code: Select all
resolver #1
  nameserver[0] : 192.168.2.1
  if_index : 4 (en0)
  flags    : Request A records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)
Can you check on your Mac in the network settings, advanced settings, whether 1.1.1.1 was added manually?
Top
 
derolf
just joined
Topic Author
Posts: 7
Joined: Sat Apr 13, 2024 6:29 pm

Re: Hide upstream DNS name server from clients

Wed Apr 17, 2024 12:09 pm

You should remove the 1st entry with 0.0.0.0/24 and add dns-server=192.168.178.1 to the 2nd entry (in WinBox just enter that address in the DNS textbox).
This fixed it.

BTW. It was not only my Mac, but other devices got 1.1.1.1 as well, which resulted in LAN lookup failures.
Top
Post Reply

Who is online

Users browsing this forum: andrewdl, Bing [Bot], jaclaz and 22 guests
  4. RouterOS
  5. Beginner Basics