I call it harmless because everything works well until a smart user gets connected to your network.

The harmless mistake is usually in the firewall rule. There are basically two things to do when trying to block access to some websites on a Mikrotik router: create a layer 7 protocol with all websites to be blocked listed, and configure a firewall deny rule that will make use of the layer 7 protocol. But nor the mikrotik or clients get DNS answer from the new PiHole.I have made several posts on how to block websites using Mikrotik routers but for the sake of this post, I will be working us through the creation of a Mikrotik layer 7 rule to block websites, point out the mistake that can allow users gain access to these blocked sites via VPN, and finally show us how to ensure users do not have the last laugh. In DHCP I only switch from my 'old' PiHole to my 'new' PiHole which is in the Mikrotik container and then stops working.Ĭlients in this case are always asking mikrotik for DNS. I set my DNS IP to be the Mikrotik it self so that my core mikrotik has all of the DNS records. DNS IP is new Pi-hole and that Pi-hole in configuration doesn't have upstream DNS IP of MT DNS, maybe some public like 8.8.8.8.DNS IP is of old Pi-hole and that Pi-hole in configuration have upstream DNS IP of new Pi-hole instead MT DNS and new Pi-hole doesn't have upstream DNS IP of MT DNS (+ chaining Pi-holes doesn't make much sense).

Possibilities depending on client's DNS IP: Which DNS IP address clients receive? Assuming that is set over DHCP, not manually. 0 R name='veth1' address=172.17.0.2/24 gateway=172.17.0.1Ĭhain=srcnat action=masquerade src-address=172.17.0.0/24 out-interface=ISP log=no log-prefix=''Ġ name='4b45ab04-2116-4008-9254-93fe8251fc5e' tag='pihole/pihole:latest' os='linux' arch='arm' interface=veth1Įnvlist='pihole_envs' root-dir=disk1/pihole mounts=etc_pihole,dnsmasq_pihole dns='' status=errorĬolumns: SLOT, MODEL, SERIAL, INTERFACE, SIZEĠ b disk1 Generic USB Storage 000000000272 USB 2.00 480Mbps 62 537 072 640Ġ name='pihole_envs' key='TZ' value='Europe/Zagreb'ġ name='pihole_envs' key='WEBPASSWORD' value='xxxxxxxxxx'Ģ name='pihole_envs' key='DNSMASQ_USER' value='root'Ġ name='etc_pihole' src='/disk1/etc' dst='/etc/pihole'ġ name='dnsmasq_pihole' src='/disk1/etc-dnsmasq.d' dst='/etc/dnsmasq.d'īut I can see the requests in the new PiHole which is really strange - my DNS cash is not filling up in mikrotik

Layer7 mikrotik