Exclude IPs from NAT rules (DNS redirect)

Eldowin · Mon Mar 30, 2020 9:52 pm

Hi,

I'm trying to configure a DNS redirect for all my client IPs, except a specific IP range. The DNS redirect works fine, but the excluded IP range gets ignored so far. Something seems to be wrong with my config. I tried this with address-lists and with one single IP address, but the result was the same.

Following configuration:

# Create a list for the excluded IP Range
/ip firewall address-list 
add list=UseLocalDNS address=192.168.10.220-224
add list=UseLocalDNS address=192.168.20.220-224

# Create NAT rule to redirect DNS to 192.168.255.1 for all IPs, except the IPs in the address-list "UseLocalDNS"
/ip firewall nat
add chain=dstnat action=dst-nat src-address-list=!UseLocalDNS to-addresses=192.168.255.1 to-ports=53 protocol=tcp dst-port=53
add chain=dstnat action=dst-nat src-address-list=!UseLocalDNS to-addresses=192.168.255.1 to-ports=53 protocol=udp dst-port=53

Would be great to get some help. Thanks a lot!

Best regards

msatter · Mon Mar 30, 2020 10:23 pm

You are in different subnets and if the clients know the DNS server in a other subnet then I would source nat.

If you want to rewrite the destination address then you need to stay in same subnet 192.168.0.0/16 and not /24 for each subnet. The DNS server can't find the way back to otherwise.

anav · Mon Mar 30, 2020 10:49 pm

I dont think its a particularly useful exercise to split a subnet in functionality as in IP ranges........
Much better to separate in vlans, and if you need them to talk to each other then make the necessary firewall rules.
Then you can redirect in NAT rules very easily or whatever functionality you need impart.

add chain=dstnat action=redirect source-address-list etc.......... one for udp one for tcp port 53
source-address list contains vlanX and vlanY but not vlanZ

Eldowin · Mon Mar 30, 2020 11:09 pm

Thanks for the replies.

There should be no problem regarding the different subnets. Each subnet is assigned to a VLAN, where each client is able to communicate with each other. There is a route back to both client subnets, which allows direct communication between the clients and the DNS server. The Mikrotik router routes between all subnets.

The only issue with my NAT rules: The excluded address-list gets ignored.

The DNS traffic of both subnets gets correctly forwarded to the DNS server. Something seems to be wrong with the NAT rule, because the exclusion doesn't work.

msatter · Tue Mar 31, 2020 12:51 am

Do the counters increase on those two lines if there is traffic natted?

Exclude IPs from NAT rules (DNS redirect)

Exclude IPs from NAT rules (DNS redirect)

Re: Exclude IPs from NAT rules (DNS redirect)

Re: Exclude IPs from NAT rules (DNS redirect)

Re: Exclude IPs from NAT rules (DNS redirect)

Re: Exclude IPs from NAT rules (DNS redirect)