Community discussions

MikroTik App
 
bematft
just joined
Topic Author
Posts: 22
Joined: Mon Mar 04, 2013 9:17 am
Location: Hungary

Remote Name Server

Mon Aug 26, 2019 6:21 pm

I have a RB433AH router. My network has fix IP (from ISP)
A make a sub-domain (fe. sub.mydomain.com) in my domain provider... It works fine I tried from tracert (from outside my network)
The domain is alive (tracert above):
Tracing route to sub.mydomain.com [ip myaddress]
1 38 ms * 1 ms router.lan [192.168.11.1]
2 * 115 ms 6 ms compalhub.home [192.168.0.1]
3 30 ms * * catv-x.catv.broadband.hu [x]
4 14 ms 20 ms 23 ms catv-x.catv.broadband.hu [x]
5 33 ms 17 ms 15 ms hu-bud04a-rc1-ae35-2013.aorta.net [x]
6 20 ms 22 ms 23 ms hu-bud06a-ri1-ae15-0.aorta.net [84.116.137.210]
7 20 ms 23 ms 20 ms bix.giganet.hu [193.188.137.141]
8 21 ms 29 ms 24 ms 178-248-204-x.giganetx.hu [178.248.204.x]
9 23 ms 24 ms 45 ms r.dogunetx.hu [178.x.x.x]
10 27 ms 33 ms 29 ms x-x-y-y.racom.hu [x.x.y.y] <- This is my own fix IP address....

I would like to use it for a web server...

I made static DNS in mikrotik /IP DNS (sub.mydomain.com)...
Symptom:
1. From Inside in my local network: The web server is answering, works fine.
2. When I add 80 port forward in NAT (in mikrotik) works fine from outside my local network.

My question:
Could I use one IP address to two (or more) domain?
How could I delegate to sub.domain.com to world wide? Could I use this infrastructure, anyway?

The microtik OS suitable to delegate Domain Names to outside?
In this case, What is "Allow remote Requests" in DNS settings?

Thanks for your answer!
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 13071
Joined: Thu Mar 03, 2016 10:23 pm

Re: Remote Name Server  [SOLVED]

Mon Aug 26, 2019 6:55 pm

Could I use one IP address to two (or more) domain?
Yes, if different subdomains resolve to same IP address. Most (if no all) HTTP servers support name based virtual servers. Non-ancient HTTPS srrvers do as well (using TLS SNI).

How could I delegate to sub.domain.com to world wide? Could I use this infrastructure, anyway?

The microtik OS suitable to delegate Domain Names to outside?
No, DNS server implementation in ROS is not complete and is thus unable to serve as authoritative DNS server for a (sub)domain. It supports servind static entries, but that's essentially limited to serving A and PTR records.

In this case, What is "Allow remote Requests" in DNS settings?
DNS server in ROS can resolve DNS queries for their clients if allow remote requests is enabled. If it's not, then DNS server will only accept resolve requests for its own use.
 
bematft
just joined
Topic Author
Posts: 22
Joined: Mon Mar 04, 2013 9:17 am
Location: Hungary

Re: Remote Name Server

Tue Aug 27, 2019 9:42 am

Tank You "mkx"!

May I install NS behind Mikrotik? (for this plan)
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 13071
Joined: Thu Mar 03, 2016 10:23 pm

Re: Remote Name Server

Tue Aug 27, 2019 10:55 am

May I install NS behind Mikrotik? (for this plan)

Sure you can. And establish port forwarding (port 53, protocols both TCP and UDP, forwarded to the server you'll use as NS).
 
bematft
just joined
Topic Author
Posts: 22
Joined: Mon Mar 04, 2013 9:17 am
Location: Hungary

Re: Remote Name Server

Tue Aug 27, 2019 4:01 pm

Sure you can. And establish port forwarding (port 53, protocols both TCP and UDP, forwarded to the server you'll use as NS).
Well done...Thanks.

Some problem escalated...
I installed a Bind9 and configured... As I set up the Bind9 NS server ip into my DNS list (fe.: DHCP or manualy)
In my local network is fine...Also via VPN.
But not from world wide... (remember, via my provider find "outside" of my mikrotik os ip) How can I forward 53 request? In NAT (dstnat) I tried, but something not work....
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 13071
Joined: Thu Mar 03, 2016 10:23 pm

Re: Remote Name Server

Tue Aug 27, 2019 4:43 pm

Tripple-check that the DST-NAT rule is correct. Also verify that firewall filter rules allow that connection (default filter rule allowing connections with connection-state=dst-nat is fine). Check bind config that it is not denying resolution for non-local clients (it should allow resolution of domains it is authoritative for everybody ... and should do usual (recursive) resolution only for local clients).
At the end of the day it could be your ISP filtering DNS ports (those are often abused for DDOS attacks).