v7 doh dns configuration #11
https://buananet.com/routeros-cli-han...
Excellent reference for Mikrotik router command syntax.
Secure DNS server setup video #11
This video has pre-requisite videos numbers 3,4,5,6,10 as named on the playlist that need to be exercised first. Then ensure the router is backed up in both maintenance mode and inservice mode.
This video will result in a secure DNS remote server that must be used by all users on this router. This will prevent man-in-the-middle DNS lookups.
In this video an internet connection is required so we want to leave the bottom cable plugged in (gateway), and ensure router "inservice" mode. Now access the router using ssh with keys for security reasons. We will not need Winbox in this lesson.
With the syntax listed below, the Pound Sign (#) indicates a comment line and is not copied and pasted into the router. An plus sign (+) is the terminal response to that action. All lines starting with forward slash (/) or starting with a word, need to be copied and pasted into the termiinal one line at a time and then "press enter" to execute that line before doing the next line. Ensure each line entry comes back to either a prompt or the response listed below without errors.
On your browser, using this router, go to https://one.one.one.one/help/ to test that secure DOH DNS server will fail. Proof that you need this secure DNS install.
Access your router using ssh with keys. Then do the following to ensure ssh is the only active service.
/ip/service
print
#results - only ssh should be active.
/tool fetch url=https://curl.se/ca/cacert.pem
results
status: finished
total: 199KiB
duration: 1s
/certificate import file-name=cacert.pem passphrase=""
results
certificates-imported: 128
private-keys-imported: 0
files-imported: 1
decryption-failures: 0
keys-with-no-certificate: 0
/ip dns
set use-doh-server=https://cloudflare-dns.com/dns-query verify-doh-cert=yes
DOH is now installed
/ip dns static
add name=cloudflare-dns.com address=104.16.248.249
add name=cloudflare-dns.com address=104.16.249.249
add name=cloudflare-dns.com address=2606:4700:4700::6810:f8f9
add name=cloudflare-dns.com address=2606:4700:4700::6810:f9f9
static entries added
On your browser got to https://one.one.one.one/help/ to test the secure DOH DNS server.
/ip dns
set servers=""
clear legacy servers
/ip dhcp-client
set 0 use-peer-dns=no
disregard upstream DNS server requests
#/ipv6 dhcp-client - no ipv6 dhcp server nor client configured at this time.
#set 0 use-peer-dns=no
disregard upstream DNS server requests for ipv6
all DNS lookups are now done with this router using DOH.