Thanks for these video shorts, many are great for getting me started on all the little config features and tweaks that I don’t need to get a router working but are useful. Without these videos to jumpstart me, the little things always seem to stay on my todo list and never get done.
awesome! i just broght a hex s model two days ago because i saw the possibility in mikrotiks to run containers (i didnt saw that this model does not have container support). my original idea was to run pihole and unbound to perform doh and ad blocking as I doing with my original server. now i can see that i dont need this because it is possible to use mikrotik! greetings from brazil!!
Awesome video I was looking for a alternative doh to cloudflare and now testing nextdns thanks again and keep it up. Hope you guys cover layer 3 hardware offloading on your switches at some point would be good to have a quick video on how it should be setup.
i just tried this and seems like "Redirect DNS queries to router" don't get traffic or packets. It's always 0 which i think none of the traffic passes thru that filter or settings.
Hi Mikrotik team🤗, I really missed a video like this, I was really looking forward to a detailed video, 🤩thanks for this video🤩. I have a question. Are there plans to add DoQ (DNS over QUIC)? If so, how soon will it appear (approximately how soon)? Thanks for your attention😊🙂
@MikrotikLatvia DoH on Mikrotik broken many many years. Nextdns / Adguard / Google dns, any DoH dns, after a while, they start throwing errors "DoH max concurrent queries reached, ignoring query". On different devices with different architectures, including CHR. Endless threads on forums and on the Internet lead to dead ends. There is no solution. I just checked again with CHR 7.6 and the situation has not changed.
max concurrent queries of course I changed to 500/1000/2000. it seems that this parameter does not work at all. In a small network of 5 PCs there cannot be that many requests.
1. How long is available the certificate from nextfdns? Shall we put the new cert when it expire? 2. How to redirect ipv6 dns request as there is no nat menu on ipv6>firewall on version 6
Pardon for my stupid question, but why using dstnat chain in the firewall rules? The docs say that "this type of NAT is performed on packets that are destined for the natted network". So to me it looks like the firewall will process packets coming from WAN interface to the local network. Why not srcnat?
@@mikrotik Thanks, it looks like documentation is somewhat confusing, because in some places it simplifies these definitions (src-nat and dst-nat) to most common use cases (like NAT and port forwarding), and in other places (like packet flow diagrams) they are used in many stages. Not to say that there are chains and actions named the same, but not necessarily go in pairs. Would be nice if docs did some clarification at the beginning of the topic/chapter.
@@mikrotik If the DoH server goes down, my Mikrotik clients cannot access the sites, although 2 normal DNS are specified besides the DoH. Why can't regular DNS be used when not connected to DoH?
as far as I know, PiHole itself does not support DoH, but you can use the NextDNS service like the video shows. It has the same functions as PiHole (like stop ads, block malware) and you don't need PiHole anymore
@@mikrotik Pi-hole is more user manageable and efficient in filtering ads. I would also like to have pihole in between. Also for reducing traffic to NextDNS.
This settings will handle the external DNS communication behind the Mikrotik NAT firewall and what about local DNS server on Microsoft active directory, should be also changed, or it is not necessary to encrypt LAN DNS requests ? In my opinion it is not necessary in LAN network, because there many notebooks and portable devices, that users carry to home and office. This tutorial hides DNS requests behind Mikrotik router from LAN to internet only if I understand correctly...
The data that is transmitted from the router to the server is encrypted, but not from the clients to the router? It turns out that it is possible to carry out a man-in-the-middle attack on a local network, right? How do I make DOH 443 from devices to the router?
Have 2 days running and got 100k+ nextdns queries but on Analytics->Encrypted DNS(lower right) says zero percent. What DNS IP should be set on DHCP Server LAN side?
can we either have proper support for glue records or have FWD entries work in conjunction with DoH? because glue record doesn't work, i'm forced to use FWD, and because DoH doesn't work with FWD, i cant enable it.
Not working with having vlans active. There are no DNS declared on the vlans dhcp. There is ping out on the internet, but no DNS reach on the vlans. Any idea?
@@mikrotik did you have something less complex, for example pointing DNS traffic to serwer and that serwer will be reachable from different bridges - different subnet?
as far as I know, PiHole itself does not support DoH, but you can use the NextDNS service like the video shows. It has the same functions as PiHole (like stop ads, block malware) and you don't need PiHole anymore
@@mikrotik I meant to use it together. NextDNS DoH as upstream in pi-hole. I tried, but browser wont load anything back. However queries are filled both in pi-hole and NextDNS.
@S K I prefer to reduce queries by first blocking in pi-hole (or AdGuard) and then sent DoH to NextDNS. I tried comination of both, but pihole queries are filled already with encrypted DoH adresses, so it is useless now. device -> pihole/adguard home -> DoH to NextDNS
@S K What about client -> router -> pihole -> router -> DoH NextDNS -> internet ? Instead of using unbound that I cannot get to work properly I can send filtered DNS from pihole back to router and then encrypted to NextDNS. How can I achieve this? What firewall rules to use?
Good video. Works perfect. Exept fact that NextDNS is sending all trafic to RUSSIA Moscow servers. So there newer will be trust on NextDNS. And there are no way to change servers. But thanks for video. Good tutorial
Hello there. I watch your chennel since 2021. I am working as a system administrator now using MikroTik's router. This one has a lot of posibilities to improve the network. What about this video- I used nextdns but i would say this dns server isn't such secure for me. Many packets are transfered to nextdns and they are controlled by this server. Nobody guarantees that your personal information will be leaked. This is my IMHO. What can say the author of the video about this situation? Thanks for reply.
Big corporations want this to become the standard so that we can't block advertisements with DNS anymore. So for every small name it would open and tear down an SSL connection with a big certificate?
Thanks for these video shorts, many are great for getting me started on all the little config features and tweaks that I don’t need to get a router working but are useful. Without these videos to jumpstart me, the little things always seem to stay on my todo list and never get done.
awesome! i just broght a hex s model two days ago because i saw the possibility in mikrotiks to run containers (i didnt saw that this model does not have container support). my original idea was to run pihole and unbound to perform doh and ad blocking as I doing with my original server. now i can see that i dont need this because it is possible to use mikrotik! greetings from brazil!!
this is great, the journey is slow but the power of these devies is top notch! Now i have encrypted dns :)
Awesome video I was looking for a alternative doh to cloudflare and now testing nextdns thanks again and keep it up. Hope you guys cover layer 3 hardware offloading on your switches at some point would be good to have a quick video on how it should be setup.
There is also Google DoH to try
i just tried this and seems like "Redirect DNS queries to router" don't get traffic or packets. It's always 0 which i think none of the traffic passes thru that filter or settings.
Not sure if IPv6 NAT was available when this video was posted, but would the NAT rules for IPv6 be identical?
Hi Mikrotik team🤗, I really missed a video like this, I was really looking forward to a detailed video, 🤩thanks for this video🤩.
I have a question.
Are there plans to add DoQ (DNS over QUIC)? If so, how soon will it appear (approximately how soon)?
Thanks for your attention😊🙂
@MikrotikLatvia DoH on Mikrotik broken many many years. Nextdns / Adguard / Google dns, any DoH dns, after a while, they start throwing errors "DoH max concurrent queries reached, ignoring query". On different devices with different architectures, including CHR. Endless threads on forums and on the Internet lead to dead ends. There is no solution. I just checked again with CHR 7.6 and the situation has not changed.
max concurrent queries of course I changed to 500/1000/2000. it seems that this parameter does not work at all. In a small network of 5 PCs there cannot be that many requests.
I don't have this problem on hap ac2 with cloud flare's DOH. I have max concurrent queries 100 and max concurrent tcp sessions 20
Max queries setting does not apply to DoH, you are changing the setting without any reason. Leave it alone if you use DoH
1. How long is available the certificate from nextfdns? Shall we put the new cert when it expire?
2. How to redirect ipv6 dns request as there is no nat menu on ipv6>firewall on version 6
Pardon for my stupid question, but why using dstnat chain in the firewall rules? The docs say that "this type of NAT is performed on packets that are destined for the natted network". So to me it looks like the firewall will process packets coming from WAN interface to the local network. Why not srcnat?
No, DST-NAT translates packets from any to any network. Including from LAN to router etc.
@@mikrotik Thanks, it looks like documentation is somewhat confusing, because in some places it simplifies these definitions (src-nat and dst-nat) to most common use cases (like NAT and port forwarding), and in other places (like packet flow diagrams) they are used in many stages. Not to say that there are chains and actions named the same, but not necessarily go in pairs. Would be nice if docs did some clarification at the beginning of the topic/chapter.
@@mikrotik If the DoH server goes down, my Mikrotik clients cannot access the sites, although 2 normal DNS are specified besides the DoH. Why can't regular DNS be used when not connected to DoH?
Can the certificate be downloaded without a computer I only use the phone
Thank you Normis, but can we have multiple DoH entry on RouterOS just like the regular DNS?
Thanks for video, but i have one question, - if i using pi-hole in my home network, what settings are needed in this case?
as far as I know, PiHole itself does not support DoH, but you can use the NextDNS service like the video shows. It has the same functions as PiHole (like stop ads, block malware) and you don't need PiHole anymore
@@mikrotik Pi-hole is more user manageable and efficient in filtering ads. I would also like to have pihole in between. Also for reducing traffic to NextDNS.
Hi!
I miss where can we get the ID mentioned at min 3:52 ?
When registering on NextDNS website
Hi. "to be extra safe you can just drop port 53 in the firewall output chain". Ok, it must be "Src.Port" or "Dst.Port" ?
Destination port
This settings will handle the external DNS communication behind the Mikrotik NAT firewall and what about local DNS server on Microsoft active directory, should be also changed, or it is not necessary to encrypt LAN DNS requests ? In my opinion it is not necessary in LAN network, because there many notebooks and portable devices, that users carry to home and office. This tutorial hides DNS requests behind Mikrotik router from LAN to internet only if I understand correctly...
The data that is transmitted from the router to the server is encrypted, but not from the clients to the router? It turns out that it is possible to carry out a man-in-the-middle attack on a local network, right? How do I make DOH 443 from devices to the router?
You can simply make DoH from client directly to DoH server. No need to involve the router in this case
In your internal network its fine just to use dns 53.
4:18 Если создаю эти два NAT rules, пропадает инет в гостевой сети. Без них всё работает, и DoH тоже.
The NAT rules presented do not work when DNS is performing DoH.
The whole point of the video is to use DoH, what do you mean
Still confused. if the ISP using transparent DNS, is setting up DNS on the mikrotik useless, coz we're forced to use the ISP's DNS
No, with DoH secure DNS, the ISP can't intercept it. This is the benefit of DoH.
@@mikrotik meaning the same thing can be done by any device/user behind MikroTik in order to bypass DNS proxying enforced by firewall rule
Have 2 days running and got 100k+ nextdns queries but on Analytics->Encrypted DNS(lower right) says zero percent. What DNS IP should be set on DHCP Server LAN side?
Im looking for NSlooup funktion on Mikrotik Routers is ther a howto online?
:resolve www.example.com
can we either have proper support for glue records or have FWD entries work in conjunction with DoH?
because glue record doesn't work, i'm forced to use FWD, and because DoH doesn't work with FWD, i cant enable it.
Not working with having vlans active. There are no DNS declared on the vlans dhcp. There is ping out on the internet, but no DNS reach on the vlans. Any idea?
Gives me error: DoH server connection error: Idle timeout - connecting
I can't resolve
Routeros is far better than openwrt and pfsense.
Oh, where vless+reality?))
And how to redirect all DNS queries to for example Pi-Hole - external DNS, not MT device.
We have a video about PiHole ua-cam.com/video/UMcJs4oyHDk/v-deo.html
@@mikrotik did you have something less complex, for example pointing DNS traffic to serwer and that serwer will be reachable from different bridges - different subnet?
You mean custom upstream from pihole?
@@JemiToShumafuk ua-cam.com/video/EdzDCkFaskc/v-deo.html
Is it possible to combine it with pi-hole in container?
as far as I know, PiHole itself does not support DoH, but you can use the NextDNS service like the video shows. It has the same functions as PiHole (like stop ads, block malware) and you don't need PiHole anymore
@@mikrotik I meant to use it together. NextDNS DoH as upstream in pi-hole. I tried, but browser wont load anything back. However queries are filled both in pi-hole and NextDNS.
@S K I prefer to reduce queries by first blocking in pi-hole (or AdGuard) and then sent DoH to NextDNS. I tried comination of both, but pihole queries are filled already with encrypted DoH adresses, so it is useless now.
device -> pihole/adguard home -> DoH to NextDNS
@S K What about client -> router -> pihole -> router -> DoH NextDNS -> internet ? Instead of using unbound that I cannot get to work properly I can send filtered DNS from pihole back to router and then encrypted to NextDNS.
How can I achieve this? What firewall rules to use?
Excellent!!!!
and easy ;)
Good video. Works perfect. Exept fact that NextDNS is sending all trafic to RUSSIA Moscow servers. So there newer will be trust on NextDNS. And there are no way to change servers. But thanks for video. Good tutorial
Hello there. I watch your chennel since 2021. I am working as a system administrator now using MikroTik's router. This one has a lot of posibilities to improve the network. What about this video- I used nextdns but i would say this dns server isn't such secure for me. Many packets are transfered to nextdns and they are controlled by this server. Nobody guarantees that your personal information will be leaked. This is my IMHO. What can say the author of the video about this situation? Thanks for reply.
This is clearly mentioned in the video itself
Big corporations want this to become the standard so that we can't block advertisements with DNS anymore. So for every small name it would open and tear down an SSL connection with a big certificate?
The video describes using NextDNS, which itself blocks advertisements. Your statement is completely wrong
No, it will open few connections and will keep them alive and reuse, overhead is not that big if you take dns cache into account
Thx for shared ❤
Mikrotik very unstable when using dns services like controld, nextdns and adguard dns cloud even use latest version 7
It’s not true. Email our support if you are seeing any problems. Maybe the configuration can be improved
And please improve the stability of ROS DOH
افضل dns
NextDNS can be used for free up to 300,000 queries each month, after which all features will be disabled temporarily until next month.
Unfair discovery I also discovered
Can the certificate be downloaded without a computer I only use the phone