Yesterday I upgraded a Mikrotik router from version 7.6 to 7.10.2. After that, the DNS no longer works on the network somehow. Never had any problems in the past so I think my original setup was fine. I'm trying to figure out the problem now, but I don't see what's going wrong. If anyone has any tips on how to troubleshoot further or sees the solution that would be great!
Via DHCP I first give all clients the IP of my AdGuard and as a second DNS server the IP of the Mikrotik router as a backup when the AdGuard server fails.
From clients in the network I can still use all services internally in the network perfectly. When I do a curl request to https://1.0.0.1 it just works. Pinging to external IPs also works smoothly. However, with dig I cannot resolve any DNS requests (Mikrotik DNS, Internal Adguard DNS, external DNS servers).
I've added a firewall rule to make sure port 53 isn't blocked but this doesn't seem to be the problem. (The rule has already accepted more than 150,000 packets since yesterday and sees it constantly rising).
I've tested the DNS from an Ubuntu client like this:
Code: Select all
user@client:~$ dig @192.168.88.1 google.com
;; communications error to 192.168.88.1#53: timed out
;; communications error to 192.168.88.1#53: timed out
;; communications error to 192.168.88.1#53: timed out
; <<>> DiG 9.18.12-0ubuntu0.22.04.2-Ubuntu <<>> @192.168.88.1 google.com
; (1 server found)
;; global options: +cmd
;; no servers could be reached
user@client:~$ dig @192.168.88.100 google.com
;; communications error to 192.168.88.100#53: timed out
;; communications error to 192.168.88.100#53: timed out
;; communications error to 192.168.88.100#53: timed out
; <<>> DiG 9.18.12-0ubuntu0.22.04.2-Ubuntu <<>> @192.168.88.100 google.com
; (1 server found)
;; global options: +cmd
;; no servers could be reached
user@client:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=31.3 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=15.0 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=58 time=13.9 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=58 time=12.8 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=58 time=13.9 ms
64 bytes from 8.8.8.8: icmp_seq=6 ttl=58 time=12.0 ms
64 bytes from 8.8.8.8: icmp_seq=7 ttl=58 time=15.6 ms
64 bytes from 8.8.8.8: icmp_seq=8 ttl=58 time=13.1 ms
^C
--- 8.8.8.8 ping statistics ---
8 packets transmitted, 8 received, 0% packet loss, time 7010ms
rtt min/avg/max/mdev = 11.984/15.941/31.314/5.910 ms
user@client:~$ dig @8.8.8.8 google.com
;; communications error to 8.8.8.8#53: timed out
;; communications error to 8.8.8.8#53: timed out
;; communications error to 8.8.8.8#53: timed out
; <<>> DiG 9.18.12-0ubuntu0.22.04.2-Ubuntu <<>> @8.8.8.8 google.com
; (1 server found)
;; global options: +cmd
;; no servers could be reached
user@client:~$ curl https://1.0.0.1
<!DOCTYPE html><html theme="light" lang="en-US" prefix="og: http://ogp.me/ns#"><head><meta charset="utf-8"><title>1.1.1.1 — The free app that makes your Internet faster.</title>Code: Select all
/ip/firewall/filter print
Flags: X - disabled, I - invalid; D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 chain=forward action=accept protocol=udp src-address=192.168.88.0/24 dst-port=53 log=no log-prefix=""
2 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked
/ip/dns print
servers: 8.8.8.8,8.8.4.4,1.1.1.1,1.0.0.1
dynamic-servers: 195.130.130.4,195.130.131.4
use-doh-server:
verify-doh-cert: no
doh-max-server-connections: 5
doh-max-concurrent-queries: 50
doh-timeout: 5s
allow-remote-requests: yes
max-udp-packet-size: 4096
query-server-timeout: 2s
query-total-timeout: 10s
max-concurrent-queries: 100
max-concurrent-tcp-sessions: 20
cache-size: 2048KiB
cache-max-ttl: 1w
address-list-extra-time: 0s
cache-used: 35KiB