Thanks for these video shorts, many are great for getting me started on all the little config features and tweaks that I don’t need to get a router working but are useful. Without these videos to jumpstart me, the little things always seem to stay on my todo list and never get done.

this is great, the journey is slow but the power of these devies is top notch! Now i have encrypted dns :)

Awesome video I was looking for a alternative doh to cloudflare and now testing nextdns thanks again and keep it up. Hope you guys cover layer 3 hardware offloading on your switches at some point would be good to have a quick video on how it should be setup.

@mikrotik

Жыл бұрын

There is also Google DoH to try

can we either have proper support for glue records or have FWD entries work in conjunction with DoH? because glue record doesn't work, i'm forced to use FWD, and because DoH doesn't work with FWD, i cant enable it.

Not working with having vlans active. There are no DNS declared on the vlans dhcp. There is ping out on the internet, but no DNS reach on the vlans. Any idea?

Can the certificate be downloaded without a computer I only use the phone

1. How long is available the certificate from nextfdns? Shall we put the new cert when it expire? 2. How to redirect ipv6 dns request as there is no nat menu on ipv6>firewall on version 6

This settings will handle the external DNS communication behind the Mikrotik NAT firewall and what about local DNS server on Microsoft active directory, should be also changed, or it is not necessary to encrypt LAN DNS requests ? In my opinion it is not necessary in LAN network, because there many notebooks and portable devices, that users carry to home and office. This tutorial hides DNS requests behind Mikrotik router from LAN to internet only if I understand correctly...

Have 2 days running and got 100k+ nextdns queries but on Analytics->Encrypted DNS(lower right) says zero percent. What DNS IP should be set on DHCP Server LAN side?

Thx for shared ❤

i just tried this and seems like "Redirect DNS queries to router" don't get traffic or packets. It's always 0 which i think none of the traffic passes thru that filter or settings.

Hi Mikrotik team🤗, I really missed a video like this, I was really looking forward to a detailed video, 🤩thanks for this video🤩. I have a question. Are there plans to add DoQ (DNS over QUIC)? If so, how soon will it appear (approximately how soon)? Thanks for your attention😊🙂

Thank you Normis, but can we have multiple DoH entry on RouterOS just like the regular DNS?

Excellent!!!! and easy ;)

Gives me error: DoH server connection error: Idle timeout - connecting I can't resolve

Not sure if IPv6 NAT was available when this video was posted, but would the NAT rules for IPv6 be identical?

Thanks for video, but i have one question, - if i using pi-hole in my home network, what settings are needed in this case?

@mikrotik

Жыл бұрын

as far as I know, PiHole itself does not support DoH, but you can use the NextDNS service like the video shows. It has the same functions as PiHole (like stop ads, block malware) and you don't need PiHole anymore

@JemiToShumafuk

Жыл бұрын

@@mikrotik Pi-hole is more user manageable and efficient in filtering ads. I would also like to have pihole in between. Also for reducing traffic to NextDNS.

Pardon for my stupid question, but why using dstnat chain in the firewall rules? The docs say that "this type of NAT is performed on packets that are destined for the natted network". So to me it looks like the firewall will process packets coming from WAN interface to the local network. Why not srcnat?

@mikrotik

Жыл бұрын

No, DST-NAT translates packets from any to any network. Including from LAN to router etc.

@gosich

Жыл бұрын

@@mikrotik Thanks, it looks like documentation is somewhat confusing, because in some places it simplifies these definitions (src-nat and dst-nat) to most common use cases (like NAT and port forwarding), and in other places (like packet flow diagrams) they are used in many stages. Not to say that there are chains and actions named the same, but not necessarily go in pairs. Would be nice if docs did some clarification at the beginning of the topic/chapter.

@WIN4iG

11 ай бұрын

@@mikrotik If the DoH server goes down, my Mikrotik clients cannot access the sites, although 2 normal DNS are specified besides the DoH. Why can't regular DNS be used when not connected to DoH?

Hi. "to be extra safe you can just drop port 53 in the firewall output chain". Ok, it must be "Src.Port" or "Dst.Port" ?

@mikrotik

Жыл бұрын

Destination port

Hi! I miss where can we get the ID mentioned at min 3:52 ?

@mikrotik

8 ай бұрын

When registering on NextDNS website

Still confused. if the ISP using transparent DNS, is setting up DNS on the mikrotik useless, coz we're forced to use the ISP's DNS

@mikrotik

6 ай бұрын

No, with DoH secure DNS, the ISP can't intercept it. This is the benefit of DoH.

@vadym.masiuk

27 күн бұрын

@@mikrotik meaning the same thing can be done by any device/user behind MikroTik in order to bypass DNS proxying enforced by firewall rule

Good video. Works perfect. Exept fact that NextDNS is sending all trafic to RUSSIA Moscow servers. So there newer will be trust on NextDNS. And there are no way to change servers. But thanks for video. Good tutorial

And please improve the stability of ROS DOH

And how to redirect all DNS queries to for example Pi-Hole - external DNS, not MT device.

@mikrotik

Жыл бұрын

We have a video about PiHole kzread.info/dash/bejne/h4GXrNVtn9yudM4.html

@piotrsulima8696

Жыл бұрын

@@mikrotik did you have something less complex, for example pointing DNS traffic to serwer and that serwer will be reachable from different bridges - different subnet?

@JemiToShumafuk

Жыл бұрын

You mean custom upstream from pihole?

@piotrsulima8696

Жыл бұрын

@@JemiToShumafuk kzread.info/dash/bejne/d5iupqWkdsTZm8Y.html

Is it possible to combine it with pi-hole in container?

@mikrotik

Жыл бұрын

as far as I know, PiHole itself does not support DoH, but you can use the NextDNS service like the video shows. It has the same functions as PiHole (like stop ads, block malware) and you don't need PiHole anymore

@JemiToShumafuk

Жыл бұрын

@@mikrotik I meant to use it together. NextDNS DoH as upstream in pi-hole. I tried, but browser wont load anything back. However queries are filled both in pi-hole and NextDNS.

@JemiToShumafuk

Жыл бұрын

@S K I prefer to reduce queries by first blocking in pi-hole (or AdGuard) and then sent DoH to NextDNS. I tried comination of both, but pihole queries are filled already with encrypted DoH adresses, so it is useless now. device -> pihole/adguard home -> DoH to NextDNS

@JemiToShumafuk

Жыл бұрын

@S K What about client -> router -> pihole -> router -> DoH NextDNS -> internet ? Instead of using unbound that I cannot get to work properly I can send filtered DNS from pihole back to router and then encrypted to NextDNS. How can I achieve this? What firewall rules to use?

Hello there. I watch your chennel since 2021. I am working as a system administrator now using MikroTik's router. This one has a lot of posibilities to improve the network. What about this video- I used nextdns but i would say this dns server isn't such secure for me. Many packets are transfered to nextdns and they are controlled by this server. Nobody guarantees that your personal information will be leaked. This is my IMHO. What can say the author of the video about this situation? Thanks for reply.

@mikrotik

Жыл бұрын

This is clearly mentioned in the video itself

Routeros is far better than openwrt and pfsense.

Mikrotik very unstable when using dns services like controld, nextdns and adguard dns cloud even use latest version 7

@mikrotik

10 ай бұрын

It’s not true. Email our support if you are seeing any problems. Maybe the configuration can be improved

Big corporations want this to become the standard so that we can't block advertisements with DNS anymore. So for every small name it would open and tear down an SSL connection with a big certificate?

@mikrotik

Жыл бұрын

The video describes using NextDNS, which itself blocks advertisements. Your statement is completely wrong

@vketsenko

Жыл бұрын

No, it will open few connections and will keep them alive and reuse, overhead is not that big if you take dns cache into account

its joke video i think. DoH with Cert verify still have memory leak.

@mikrotik

Жыл бұрын

No there isn’t any leaks. Make sure you have properly set up doh connection limits

@StahLHerZRocK

Жыл бұрын

@@mikrotik just check forum for "DOH" and "Leak". Your support is aware of the issue. A bug was opened in Jira over a year ago(if I remember correctly). This summer it was closed but there were no changes in the releases at least up to 7.7. What about ROS 6 - there are no sense to wait fix i think.

@mikrotik

Жыл бұрын

All known issues with DoH are fixed in latest releases. V6 is not updated anymore. Use v7.8

@StahLHerZRocK

Жыл бұрын

@@mikrotik may be 7.8 fixed it. I have no statistic yet. its new release. This video recorded in 7.7 version time.

@mikrotik

Жыл бұрын

In any case, there was no memory leak in 7.7 either. DoH simply had hardcoded limit on maximum number of connections, so when it was reached, it could cause issues. Now this parameter is configurable. Even 7.6 and 7.5 worked very well with DoH if you only had a few devices in your LAN

@MikrotikLatvia DoH on Mikrotik broken many many years. Nextdns / Adguard / Google dns, any DoH dns, after a while, they start throwing errors "DoH max concurrent queries reached, ignoring query". On different devices with different architectures, including CHR. Endless threads on forums and on the Internet lead to dead ends. There is no solution. I just checked again with CHR 7.6 and the situation has not changed.

@unu5ua1

Жыл бұрын

max concurrent queries of course I changed to 500/1000/2000. it seems that this parameter does not work at all. In a small network of 5 PCs there cannot be that many requests.

@vketsenko

Жыл бұрын

I don't have this problem on hap ac2 with cloud flare's DOH. I have max concurrent queries 100 and max concurrent tcp sessions 20

@mikrotik

Жыл бұрын

Max queries setting does not apply to DoH, you are changing the setting without any reason. Leave it alone if you use DoH

@StahLHerZRocK

Жыл бұрын

DoH has a more serious problem - it's a memory leak. All ros version include 7.7

NextDNS can be used for free up to 300,000 queries each month, after which all features will be disabled temporarily until next month.

@DuncanAllanByamukama

2 ай бұрын

Unfair discovery I also discovered

Can the certificate be downloaded without a computer I only use the phone