My name is Leandro, and I'm experiencing a puzzling DNS resolution problem on my MikroTik RB4011iGS+ running RouterOS version 7.11.2.
I have two internet providers: NET and Vivo. I've set up policy-based routing to direct specific devices through either the NET or Vivo connection. Direct connections to either NET or Vivo work flawlessly, as does the general connection through the MikroTik. The issue only arises when I implement this rule to direct specific devices to each of the ISPs.
Configuration Details:
To achieve policy-based routing, I've set up the following:
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip dhcp-client
add add-default-route=no interface=Net use-peer-dns=no
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=1433 in-interface-list=WAN protocol=tcp src-address-list=Liberado to-addresses=192.168.1.12 to-ports=1433
add action=dst-nat chain=dstnat dst-port=3389 in-interface-list=WAN protocol=tcp src-address-list=Liberado to-addresses=192.168.1.10 to-ports=3389
add action=dst-nat chain=dstnat dst-port=3392 in-interface-list=WAN protocol=tcp src-address-list=Liberado to-addresses=192.168.1.12 to-ports=3389
add action=dst-nat chain=dstnat dst-port=3391 in-interface-list=WAN protocol=tcp src-address-list=Liberado to-addresses=192.168.0.11 to-ports=3389
add action=dst-nat chain=dstnat dst-port=80 in-interface-list=WAN protocol=tcp to-addresses=192.168.1.12 to-ports=80
Mangle Rules:
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=net-route src-address-list=Net
add action=mark-routing chain=prerouting new-routing-mark=vivo-route src-address-list=Vivo
Routing Tables:
/routing table
add name=net-out FIB
add name=vivo-out FIB
Routes:
/ip route
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=201.82.144.1 pref-src="" routing-table=net-out scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=pppoe-vivo pref-src="" routing-table=vivo-out scope=30 suppress-hw-offload=no target-scope=10
"When I change the routing-table for main, everything starts working normally again, but all traffic goes only through the route with distance 1"
Routing Rules:
/routing rule
add routing-mark=net-route action=lookup table=net-out
add routing-mark=vivo-route action=lookup table=vivo-out
Problem:
When a device is routed through the NET connection via the MikroTik, it's unable to resolve domain names. When I ping or access a direct IP address, it works correctly, but DNS resolution fails. Running nslookup with the MikroTik as the DNS server results in a timeout, but using an external DNS (like 8.8.8.
directly works as expected.Steps Already Taken:
Confirmed the MikroTik is set to use Google's DNS servers (8.8.8.8 and 8.8.4.4).
Ensured there are no firewall rules that would block DNS traffic.
Set up masquerade rules for DNS traffic.
Ensured DHCP is providing the MikroTik's IP as the DNS server to clients.
Despite all these attempts, the issue persists. I'm wondering if anyone else has faced a similar issue or if there are any other suggestions on how to diagnose and solve this problem.
Thank you for your assistance!
