Encrypt your DNS requests with MikroTik
Vložit
- čas přidán 1. 12. 2022
- Sources and extra reading:
- help.nextdns.io/t/x2hmvas/wha...
- www.cloudflare.com/en-gb/lear...
Quick command line setup for NextDNS:
/tool fetch url=curl.se/ca/cacert.pem
/certificate import file-name=cacert.pem
/ip dns set servers=
/ip dns static add name=dns.nextdns.io address=45.90.28.0 type=A
/ip dns static add name=dns.nextdns.io address=45.90.30.0 type=A
/ip dns static add name=dns.nextdns.io address=2a07:a8c0:: type=AAAA
/ip dns static add name=dns.nextdns.io address=2a07:a8c1:: type=AAAA
/ip dns set use-doh-server=“dns.nextdns.io/fe4232” verify-doh-cert=yes
Redirect DNS queries to router:
/ip firewall nat add chain=dstnat action=redirect protocol=tcp dst-port=53
/ip firewall nat add chain=dstnat action=redirect protocol=udp dst-port=53
Documentation link:
help.mikrotik.com/docs/displa... - Věda a technologie
Thanks for these video shorts, many are great for getting me started on all the little config features and tweaks that I don’t need to get a router working but are useful. Without these videos to jumpstart me, the little things always seem to stay on my todo list and never get done.
Awesome video I was looking for a alternative doh to cloudflare and now testing nextdns thanks again and keep it up. Hope you guys cover layer 3 hardware offloading on your switches at some point would be good to have a quick video on how it should be setup.
There is also Google DoH to try
this is great, the journey is slow but the power of these devies is top notch! Now i have encrypted dns :)
Hi Mikrotik team🤗, I really missed a video like this, I was really looking forward to a detailed video, 🤩thanks for this video🤩.
I have a question.
Are there plans to add DoQ (DNS over QUIC)? If so, how soon will it appear (approximately how soon)?
Thanks for your attention😊🙂
1. How long is available the certificate from nextfdns? Shall we put the new cert when it expire?
2. How to redirect ipv6 dns request as there is no nat menu on ipv6>firewall on version 6
can we either have proper support for glue records or have FWD entries work in conjunction with DoH?
because glue record doesn't work, i'm forced to use FWD, and because DoH doesn't work with FWD, i cant enable it.
i just tried this and seems like "Redirect DNS queries to router" don't get traffic or packets. It's always 0 which i think none of the traffic passes thru that filter or settings.
Not working with having vlans active. There are no DNS declared on the vlans dhcp. There is ping out on the internet, but no DNS reach on the vlans. Any idea?
Excellent!!!!
and easy ;)
This settings will handle the external DNS communication behind the Mikrotik NAT firewall and what about local DNS server on Microsoft active directory, should be also changed, or it is not necessary to encrypt LAN DNS requests ? In my opinion it is not necessary in LAN network, because there many notebooks and portable devices, that users carry to home and office. This tutorial hides DNS requests behind Mikrotik router from LAN to internet only if I understand correctly...
Thx for shared ❤
Thank you Normis, but can we have multiple DoH entry on RouterOS just like the regular DNS?
Have 2 days running and got 100k+ nextdns queries but on Analytics->Encrypted DNS(lower right) says zero percent. What DNS IP should be set on DHCP Server LAN side?
Can the certificate be downloaded without a computer I only use the phone
Gives me error: DoH server connection error: Idle timeout - connecting
I can't resolve
Not sure if IPv6 NAT was available when this video was posted, but would the NAT rules for IPv6 be identical?
Hi. "to be extra safe you can just drop port 53 in the firewall output chain". Ok, it must be "Src.Port" or "Dst.Port" ?
Destination port
Pardon for my stupid question, but why using dstnat chain in the firewall rules? The docs say that "this type of NAT is performed on packets that are destined for the natted network". So to me it looks like the firewall will process packets coming from WAN interface to the local network. Why not srcnat?
No, DST-NAT translates packets from any to any network. Including from LAN to router etc.
@@mikrotik Thanks, it looks like documentation is somewhat confusing, because in some places it simplifies these definitions (src-nat and dst-nat) to most common use cases (like NAT and port forwarding), and in other places (like packet flow diagrams) they are used in many stages. Not to say that there are chains and actions named the same, but not necessarily go in pairs. Would be nice if docs did some clarification at the beginning of the topic/chapter.
@@mikrotik If the DoH server goes down, my Mikrotik clients cannot access the sites, although 2 normal DNS are specified besides the DoH. Why can't regular DNS be used when not connected to DoH?
Thanks for video, but i have one question, - if i using pi-hole in my home network, what settings are needed in this case?
as far as I know, PiHole itself does not support DoH, but you can use the NextDNS service like the video shows. It has the same functions as PiHole (like stop ads, block malware) and you don't need PiHole anymore
@@mikrotik Pi-hole is more user manageable and efficient in filtering ads. I would also like to have pihole in between. Also for reducing traffic to NextDNS.
Still confused. if the ISP using transparent DNS, is setting up DNS on the mikrotik useless, coz we're forced to use the ISP's DNS
No, with DoH secure DNS, the ISP can't intercept it. This is the benefit of DoH.
@@mikrotik meaning the same thing can be done by any device/user behind MikroTik in order to bypass DNS proxying enforced by firewall rule
Hi!
I miss where can we get the ID mentioned at min 3:52 ?
When registering on NextDNS website
Good video. Works perfect. Exept fact that NextDNS is sending all trafic to RUSSIA Moscow servers. So there newer will be trust on NextDNS. And there are no way to change servers. But thanks for video. Good tutorial
And please improve the stability of ROS DOH
And how to redirect all DNS queries to for example Pi-Hole - external DNS, not MT device.
We have a video about PiHole czcams.com/video/UMcJs4oyHDk/video.html
@@mikrotik did you have something less complex, for example pointing DNS traffic to serwer and that serwer will be reachable from different bridges - different subnet?
You mean custom upstream from pihole?
@@JemiToShumafuk czcams.com/video/EdzDCkFaskc/video.html
Big corporations want this to become the standard so that we can't block advertisements with DNS anymore. So for every small name it would open and tear down an SSL connection with a big certificate?
The video describes using NextDNS, which itself blocks advertisements. Your statement is completely wrong
No, it will open few connections and will keep them alive and reuse, overhead is not that big if you take dns cache into account
Hello there. I watch your chennel since 2021. I am working as a system administrator now using MikroTik's router. This one has a lot of posibilities to improve the network. What about this video- I used nextdns but i would say this dns server isn't such secure for me. Many packets are transfered to nextdns and they are controlled by this server. Nobody guarantees that your personal information will be leaked. This is my IMHO. What can say the author of the video about this situation? Thanks for reply.
This is clearly mentioned in the video itself
@MikrotikLatvia DoH on Mikrotik broken many many years. Nextdns / Adguard / Google dns, any DoH dns, after a while, they start throwing errors "DoH max concurrent queries reached, ignoring query". On different devices with different architectures, including CHR. Endless threads on forums and on the Internet lead to dead ends. There is no solution. I just checked again with CHR 7.6 and the situation has not changed.
max concurrent queries of course I changed to 500/1000/2000. it seems that this parameter does not work at all. In a small network of 5 PCs there cannot be that many requests.
I don't have this problem on hap ac2 with cloud flare's DOH. I have max concurrent queries 100 and max concurrent tcp sessions 20
Max queries setting does not apply to DoH, you are changing the setting without any reason. Leave it alone if you use DoH
DoH has a more serious problem - it's a memory leak. All ros version include 7.7
Is it possible to combine it with pi-hole in container?
as far as I know, PiHole itself does not support DoH, but you can use the NextDNS service like the video shows. It has the same functions as PiHole (like stop ads, block malware) and you don't need PiHole anymore
@@mikrotik I meant to use it together. NextDNS DoH as upstream in pi-hole. I tried, but browser wont load anything back. However queries are filled both in pi-hole and NextDNS.
@S K I prefer to reduce queries by first blocking in pi-hole (or AdGuard) and then sent DoH to NextDNS. I tried comination of both, but pihole queries are filled already with encrypted DoH adresses, so it is useless now.
device -> pihole/adguard home -> DoH to NextDNS
@S K What about client -> router -> pihole -> router -> DoH NextDNS -> internet ? Instead of using unbound that I cannot get to work properly I can send filtered DNS from pihole back to router and then encrypted to NextDNS.
How can I achieve this? What firewall rules to use?
Routeros is far better than openwrt and pfsense.
Mikrotik very unstable when using dns services like controld, nextdns and adguard dns cloud even use latest version 7
It’s not true. Email our support if you are seeing any problems. Maybe the configuration can be improved
its joke video i think. DoH with Cert verify still have memory leak.
No there isn’t any leaks. Make sure you have properly set up doh connection limits
@@mikrotik just check forum for "DOH" and "Leak". Your support is aware of the issue. A bug was opened in Jira over a year ago(if I remember correctly). This summer it was closed but there were no changes in the releases at least up to 7.7. What about ROS 6 - there are no sense to wait fix i think.
All known issues with DoH are fixed in latest releases. V6 is not updated anymore. Use v7.8
@@mikrotik may be 7.8 fixed it. I have no statistic yet. its new release. This video recorded in 7.7 version time.
In any case, there was no memory leak in 7.7 either. DoH simply had hardcoded limit on maximum number of connections, so when it was reached, it could cause issues. Now this parameter is configurable. Even 7.6 and 7.5 worked very well with DoH if you only had a few devices in your LAN
NextDNS can be used for free up to 300,000 queries each month, after which all features will be disabled temporarily until next month.
Unfair discovery I also discovered
Can the certificate be downloaded without a computer I only use the phone