Микроитк DNS не работает.

http://forum.mikrotik.com/t/firewall-filter-rules-for-dns/77695/4

Hey,

Just wanted to share my firewall filter rules for DNS. I'm running RouterOS v6.46.8. These rules are designed to protect against DNS amplification attacks, and also prevent DNS spoofing.

Here's a breakdown:

*   **Rule 1: Drop invalid DNS requests.** This rule drops any DNS requests that are malformed or contain invalid data. It's a good baseline for security.
*   **Rule 2: Limit DNS request rate.** This rule limits the number of DNS requests that can be sent from a single IP address in a short period of time. This helps to prevent DNS amplification attacks.
*   **Rule 3: Allow DNS responses only from specific servers.** This rule only allows DNS responses from the DNS servers that you're using. This prevents DNS spoofing.

Here's the actual rule list:

```
/ip firewall filter
add chain=forward action=drop rule="Drop invalid DNS requests" protocol=udp dst-port=53 in-interface=ether1
add chain=forward action=rate-limit limit=1000/second rule="Limit DNS request rate" protocol=udp dst-port=53 in-interface=ether1
add chain=forward action=accept rule="Allow DNS responses from specific servers" protocol=udp src-address-list=dns_servers dst-port=53 in-interface=ether1
```

Make sure to replace `ether1` with your WAN interface and create a address list named `dns_servers` with your DNS server IP addresses.

Cheers,
[username]
#mikrotik #routeros #firewall #dns