1

I have a Mikrotik router (RB750) and my ISP uses transparent DNS proxy to hijack any DNS request to their server regardless of our chosen DNS. I have since found a workaround by dst NATing port 53 TCP and UDP traffic to port 443 and directing them all to openDNS's DNS service which accepts DNS queries at port 443.

This works well except that I was using my own DNS (on the router itself) to add static DNS entries for some of my clients. This stops working when I start redirecting DNS requests as described above. I am guessing this is because the DNS on the router accepts requests only at port 53; meanwhile, the DST NAT happens prerouting, so DNS requests coming from the client (which automatically gets the router address as the DNS address through DHCP) to the router is NATted into port 443 and the address of the openDNS server.

Any idea how to get both DNS NATting and local DNS for static DNS entries to work?

  • 1
    Wouldn't it be easier to just place a configurable router, connect all devices to it, and configure that device's DNS to your desired setting? – Ramhound May 22 '17 at 17:35
  • Or use a simple Raspberry Pi (or other SBC) to handle local DNS queries where you have full control. – Julian Knight May 22 '17 at 20:11
  • I want to avoid adding another device, I already have a mikrotik as a router which can act as a DNS server but only on port 53. I have a synology NAS which has a DNS service as well, but it is not configurable to use non-53 port – Martin May 23 '17 at 4:25
0

You should be able to specify that the destination address (General tab on Winbox for firewall rule config) not be the router by checking the ! box next to Dst. Address and typing in the router's IP. Via command line you can use set numbers=[number] dst-address=!192.168.88.1, replacing 192.168.88.1 with the actual IP if it's different.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.