ncravino / mikrotik_enforce_dns_block_doh

Router DNS enforcing and DoH Blocking for MikroTik Router OS

Mikrotik DNS and DoH (DNS over HTTP) Configs

Configuring Mikrotik to use specified DNS or DNS over HTTP

On WebFig go to IP -> DNS.

Fill in Servers with your selected TCP/UDP servers and Use DoH Server with your selected DoH server.

Or use the terminal to achieve the same config.

Redirecting all TCP/UDP DNS requests to your router

Assuming the router is on 192.168.88.1.

You can do this via IP -> Firewall -> Nat on WebFig, or via terminal (SSH/web) with:

/ip firewall nat
add chain=dstnat action=dst-nat to-addresses=192.168.88.1 to-ports=53 protocol=udp dst-port=53 log=no log-prefix="" 
add chain=dstnat action=dst-nat to-addresses=192.168.88.1 to-ports=53 protocol=tcp dst-port=53 log=no log-prefix="" 

Blocking DoH requests via address list

Using terminal since it's faster, but you can create the same via WebFig.

Create a firewall rule to drop these outgoing requests based on a list

/ip firewall filter
add action=drop chain=forward comment="drop DoH" dst-address-list="DoH Servers"

Add DoH servers to the address list

Use

/ip firewall address-list add address=IP/HOST list="DoH Servers"

E.g.:

/ip firewall address-list add address=dns.google list="DoH Servers"

See the commands for adding a full list at mirotik_doh_list_commands.txt based on data from https://github.com/oneoffdallas/dohservers (see bellow for acknowlegements and license details).

Scripts

All scripts sit under the ./scripts/ folder.

get_list.sh

Gets current master of iplist.txt from https://github.com/oneoffdallas/dohservers.

process_doh_list.sh

Processes current iplist into mikrotik commands to add addresses to the list.

generate_for_router.sh

Generates a mikrotik_all_commands.txt with the commands explained before.

usage: ./generate_for_router.sh router_internal_ip 

Notes

• Tested on WSL2 running Debian and Debian 11.
• Commands tested for RouterOS v7.6 running on Mikrotik hAP ac2.
• Please review all commands and use at your own risk.
• See BSD 3 CLAUSE LICENSE for details.

Finding Servers

You can find nice public servers at Public DNS at European Alternatives.

Acknowledgements

• Mikrotik for making awesome network hardware.
• https://european-alternatives.eu for collecting nice alternatives under one site.
• https://github.com/oneoffdallas/dohservers for making available the data under their MIT LICENSE.