Page 1 of 1
Conditional DNS forwarding
Posted: Tue Jan 25, 2011 9:05 pm
by marcodor
Hello,
We deployed routerboards in our regional branches.
All our remote computers belongs to ms active directory domain, domain controllers are located in central office.
Dns servers for remote computers are set to domain controllers, for a proper AD work.
Now, I want to setup routerboard to act as DNS server for remote computers, and forward DNS queries in a smart way:
if NAME ends with my zone to forward queries to my domain controllers, else forward them to local internet provider.
This will improve response speed, and network performance.
Something like bind has:
zone "mydomain.com" {
type forward;
forward only;
forwarders { 22.22.22.22; };
};
PLEASE include it in TODO list for v5, i think it's not hard to implement it, as you already have forwarders.
Just define "Dns Zones" as entities and linked forwarders to that zone.
Thanks in advice!
Re: Conditional DNS forwarding
Posted: Thu Jan 27, 2011 3:59 pm
by mindlesstux
I have not tested this, yet, but it should be possible to create a layer7 protocol that digs into the DNS packet and matches the domain. If the domain is matched then just silently redirect the packet to the proper dns server.
I will post again once I find time to craft and test this.
Re: Conditional DNS forwarding
Posted: Thu Jan 27, 2011 4:25 pm
by janisk
just be sure that packet that come from that other DNS resolver are with correct src address in reply, other way packet will be rejected by host, how initiated the process.
Re: Conditional DNS forwarding
Posted: Thu Jan 27, 2011 5:02 pm
by mindlesstux
Here is a little run down on how to do this, the only thing left to do is to check what janisk says but im pretty sure this handles it decently enough.
/ip firewall layer7-protocol
add name=testdns regexp=lantest.mindlesstux.com
/ip firewall nat
add action=dst-nat chain=dstnat disabled=no dst-address=4.2.2.2 dst-port=53 layer7-protocol=testdns protocol=udp to-addresses=8.8.8.8 to-ports=53
add action=dst-nat chain=dstnat disabled=no dst-address=4.2.2.2 dst-port=53 layer7-protocol=testdns protocol=tcp to-addresses=8.8.8.8 to-ports=53
1. Change the regex to match your domain.
2. Change 4.2.2.2 to be your RB DNS server
3. Change 8.8.8.8 to be your AD DNS server
*edit*
/me applies this little craft for his work domain on his home RB
Re: Conditional DNS forwarding
Posted: Thu Jan 27, 2011 5:26 pm
by fewi
To make sure this works on all networks regardless of hops and directly connected servers and clients, you could run the test for the regex in prerouting and just mark the packet, and then do both source and destination NAT on the packet so that it's forced back to the router, enabling it to send it back to the client in a format the client expects:
/ip firewall layer7-protocol
add name=testdns regexp=lantest.mindlesstux.com
/ip firewall mangle
add chain=prerouting dst-address=4.2.2.2 protocol=udp dst-port=53 layer7-protocol=testdns action=mark-connection new-connection-mark=forwarded-dns
add chain=prerouting dst-address=4.2.2.2 protocol=tcp dst-port=53 layer7-protocol=testdns action=mark-connection new-connection-mark=forwarded-dns
/ip firewall nat
add action=dst-nat chain=dstnat connection-mark=forwarded-dns to-addresses=8.8.8.8
add action=masquerade chain=srcnat connection-mark=forwarded-dns
Or something like that.
Re: Conditional DNS forwarding
Posted: Thu Jan 27, 2011 6:12 pm
by mindlesstux
wow, did not even think of that... that seems like that should be a better solution.
Also should this thread not be moved to a different forum due to its not really a beta issue anymore?
Re: Conditional DNS forwarding
Posted: Fri Jan 28, 2011 3:52 pm
by marcodor
Hello,
Big thanks to all experts for suggestiong solutions for this task.
I'll try to apply it, but it is a bit complicated for me, layer7, mangle, prerouting ... a lot of rules, a lot of router cpu usage.
I'd like to have it in DNS area of winbox, and with 2 clicks done it.
Anyway, to developers, take it in account,
I suppose dns zone forwarders, masters are a part of DNS standart, if BIND implemented it.
Thanks in advice!
Re: Conditional DNS forwarding
Posted: Mon Jun 02, 2014 10:01 pm
by Fraction
Hi,
This is definitely not a beta issue (actually not issue at all) and this topic is also quite old, but I reuse it anyway..
Explained method really works (although I would really appreciate more straightforward way to do this), but is it possible (I pretty sure it is, but my regexp-skilz are just not high enough) to forward all requests ending to '.local' with one L7 entry? If I just replace 'lantest.mindlesstux.com' with '.local', this filter hits also to addresses like domainlocal.com and
http://www.localaddress.com etc.
My target is forward all requests containing domains like a.local & site.dadsgkdslf.local to one spesific dns-server and without need to add own entry for all (those are domains used in our test-lab, so they changes quite often and maintaining those is not on my shoulders, only rule is that they always end to .local)
Re: Conditional DNS forwarding
Posted: Fri Jun 20, 2014 11:09 pm
by MrBZA
Hi,
This is definitely not a beta issue (actually not issue at all) and this topic is also quite old, but I reuse it anyway..
Explained method really works (although I would really appreciate more straightforward way to do this), but is it possible (I pretty sure it is, but my regexp-skilz are just not high enough) to forward all requests ending to '.local' with one L7 entry? If I just replace 'lantest.mindlesstux.com' with '.local', this filter hits also to addresses like domainlocal.com and
http://www.localaddress.com etc.
My target is forward all requests containing domains like a.local & site.dadsgkdslf.local to one spesific dns-server and without need to add own entry for all (those are domains used in our test-lab, so they changes quite often and maintaining those is not on my shoulders, only rule is that they always end to .local)
I'm no expert in regex either, try:
Works fine for me.
Re: Conditional DNS forwarding
Posted: Tue Jul 01, 2014 4:24 pm
by masseselsev
Any chance of this being implemented in some future release? Cmon devs, it's not the hardest request at all.
Everyone who holds more than one local dns area will thank you for sure.
And yes, thank you in advance
Re: Conditional DNS forwarding
Posted: Thu Jul 03, 2014 10:31 am
by masseselsev
Also, this workaround (l7, mangle, dst-nat etc.) stops working time to time.
Seems like it just doesn't dig out any l7 info from dns packets.
Reboot and everything is back working for some time (3+hr).
Am I the only one facing such a strange behaviour?
Re: Conditional DNS forwarding
Posted: Wed Sep 10, 2014 9:36 pm
by JoeriBe
I run OS X 10.10 DP7 and the conditional forward stopped working.
This is from the first beta of OS X 10.10 till now DP7.
An other solution would be nice to conditional forward DNS requests.
Re: Conditional DNS forwarding
Posted: Mon Mar 21, 2016 5:30 pm
by midenok
Hi,
This is definitely not a beta issue (actually not issue at all) and this topic is also quite old, but I reuse it anyway..
Explained method really works (although I would really appreciate more straightforward way to do this), but is it possible (I pretty sure it is, but my regexp-skilz are just not high enough) to forward all requests ending to '.local' with one L7 entry? If I just replace 'lantest.mindlesstux.com' with '.local', this filter hits also to addresses like domainlocal.com and
http://www.localaddress.com etc.
My target is forward all requests containing domains like a.local & site.dadsgkdslf.local to one spesific dns-server and without need to add own entry for all (those are domains used in our test-lab, so they changes quite often and maintaining those is not on my shoulders, only rule is that they always end to .local)
I'm no expert in regex either, try:
Works fine for me.
Put '$' at end to specify end:
^(.*)() is bogus, at least in terms of standard.
I vote for DNS zone forwarding feature!!!
Re: Conditional DNS forwarding
Posted: Fri May 06, 2016 10:32 pm
by tmTheMaN
Five years since the request for a dns zone forwarder and still not implemented, in a way I understand RB is not an advanced DNS server to rely on, but it's still a simple add (I guess, what do I know).
Can anyone advise if using this solution will impact the DNS resolution time ?
Re: Conditional DNS forwarding
Posted: Wed Jun 15, 2016 11:25 am
by i4jordan
I also need conditional forwarding of DNS request.
We are using a lot of Mikrotik products for VPN tunnels for branche office usage. And need DNS forwarding to AD DNS domains to authenticate users on terminals/ client computers.
Re: Conditional DNS forwarding
Posted: Mon Sep 12, 2016 9:30 am
by teamer
+1
Please, add DNS zone forwarding feature in the next release!
Re: Conditional DNS forwarding
Posted: Fri Oct 07, 2016 8:22 pm
by GreySer
Here's a way to help me redirect DNS requests for ONION sites to the tor server.
http://mybroadband.co.za/vb/showthread. ... ost7528499
Re: Conditional DNS forwarding
Posted: Wed Mar 15, 2017 2:33 pm
by AnabelMaz
This will not work for TCP. Layer7 have no posibility to detect mark and next rule to forward new tcp connection to choosen dns servers.