Community discussions

MikroTik App
 
hci
Long time Member
Long time Member
Topic Author
Posts: 633
Joined: Fri May 28, 2004 5:10 pm

DNS Allow Remote Requests

Mon Dec 03, 2012 6:50 pm

If under DNS cache you do not have "Allow Remote Requests" checked, and the router LAN is assigned 192.168.1.1, dhcp clients to the router are assigned out of 192.168.1.0/24 and router receives DNS servers from PPPoE will the clients be able to use the DNS cache on 192.168.1.1?

I do see the docs but still am not sure.

http://wiki.mikrotik.com/wiki/Manual:IP/DNS

What does "Allow Remote Requests" exactly change?
 
BinaryCrash
newbie
Posts: 41
Joined: Thu Apr 28, 2011 11:20 pm

Re: DNS Allow Remote Requests

Mon Dec 03, 2012 7:07 pm

Allow Remote Requests:

enabled = Will be a DNS Server, responding to dns requests.
disabled = Will be a DNS Client, not responding to dns request. Used only for local dns resolve. (the mikrotik itself)
 
hci
Long time Member
Long time Member
Topic Author
Posts: 633
Joined: Fri May 28, 2004 5:10 pm

Re: DNS Allow Remote Requests

Mon Dec 03, 2012 7:20 pm

So it would likely be a good idea to do this to protect the DNS cache if "Allow Remote Requests" is enabled?

/ip firewall filter
add action=drop chain=input dst-port=53 protocol=udp src-address=!192.168.1.0/24

or

/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=pppoe-out1 protocol=udp
 
BinaryCrash
newbie
Posts: 41
Joined: Thu Apr 28, 2011 11:20 pm

Re: DNS Allow Remote Requests

Fri Dec 07, 2012 12:12 am

Yes, you should block others from using your DNS Server and enable only your network to use it. Using filters, like you said.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 5388
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: DNS Allow Remote Requests

Fri Jan 18, 2019 8:37 pm

Not so fast.........
It depends upon the fiilter rules in place.
For example I have drop all else rules at the end and work on the principle of - if its not permitted its dropped.

So my input rules are as such.....
add action=accept chain=input comment="Allow LAN DNS queries-UDP" dst-port=53 \
in-interface-list=LAN protocol=udp
add action=accept chain=input comment="Allow LAN DNS queries - TCP" dst-port=\
53 in-interface-list=LAN protocol=tcp

Any other traffic on port 53 will be dropped by my last rule.
add action=drop chain=input comment="DROP ALL ELSE"

If you want to be slightly more paranoid you could always add these rules in the forward chain BEFORE
the first accept, established rule............
add action=drop chain=forward comment="Drop LAN DNS queries-UDP" dst-port=53 \
in-interface-list=WAN protocol=udp
add action=drop chain=forward comment="Drop LAN DNS queries - TCP" dst-port=\
53 in-interface-list=WAN protocol=tcp

However since I have a drop all else rule in my forward chain as the last rule, I dont think I need this.
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
MTUNA Certified, by the Ascerbic Llama!
 
pegasus123
Frequent Visitor
Frequent Visitor
Posts: 58
Joined: Tue Jul 24, 2018 7:02 am

Re: DNS Allow Remote Requests

Sat Jan 19, 2019 5:41 am

you replied to a post from 2012
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 5388
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: DNS Allow Remote Requests

Sat Jan 19, 2019 12:34 pm

I need the practice LOL.
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
MTUNA Certified, by the Ascerbic Llama!

Who is online

Users browsing this forum: ahteran, crucker, darajw, dioeyandika, Google [Bot], lmoses39 and 101 guests