Community discussions

MikroTik App
 
User avatar
Bytezone
newbie
Topic Author
Posts: 41
Joined: Tue Jul 14, 2015 6:01 am

DNS Traffic with Multi WAN Routers

Thu Jan 28, 2021 3:33 pm

Here is the network setup:

CCR 1009 (DNS, DHCP and Hotspot) --> APs
|
|__ RB750 GR3 --> WAN1
|__ RB750 GR3 --> WAN2
|__ RB750 GR3 --> WAN3
|__ RB757 GR4 --> WAN4

Every RB750 is doing Simple QoS for the WAN it's connected to .. (Mangle rules for ICMP, DNS, ACKs and other marked traffic + Queue Tree shaping)

I use google DNS in CCR 1009 and the 4 RB750 (Edge Routers)

/ip dns
set allow-remote-requests=yes cache-max-ttl=10m cache-size=8192KiB max-udp-packet-size=8192 servers=8.8.8.8,208.67.222.222


In edge routers, here is the DNS mangle rules to mark traffic in port 53 in both UDP and TCP

/ip firewall mangle
add action=mark-packet chain=prerouting new-packet-mark=DNS passthrough=no port=53 protocol=udp
add action=mark-packet chain=postrouting new-packet-mark=DNS passthrough=no port=53 protocol=udp

What is see is that Traffic marking for DNS rules above goes across one of the 4 RB750 (the default one with distance=1 in the routing table at CCR1009)
In the other 3 routers no traffic goes to port 53 rules at all (counters stay at 0).

Once i change the default WAN in CCR1009 routing table to another edge routers, then DNS traffic rules counters stars counting right away in that one and that means the DNS traffic pass to the router that is sat with distance=1 in CCR1009 only and not the other wan routers !

Can anyone tell me why is this happening ?!
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 2098
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Krugersdorp (Home town of Brad Binder)
Contact:

Re: DNS Traffic with Multi WAN Routers

Thu Jan 28, 2021 11:32 pm

You don't mention how you split the load a cross the 4 x WANs, so I can only assume:

1. Router sends the traffic across its DG with lowest distance.
2. You have configured DNS cache / proxy, so router does lookups on behalf of client devices, and follows point 1 above

BTW, both your mangle rules are exactly the same, i.e. both set to protocol udp