Less than 10 years ago, the developers of RoS (in stable 6.47) added functionality that allows you to redirect DNS queries in accordance with special rules. If earlier it was necessary to dodge with Layer-7 rules in the firewall, now it is done simply and elegantly:/ip dns static
add forward-to=192.168.88.3 regexp=".*\\.test1\\.localdomain" type=FWD
add forward-to=192.168.88.56 regexp=".*\\.test2\\.localdomain" type=FWD
There is no limit to my happiness!How does this threaten us?
At the very least, we get rid of weird NAT constructs like this one:
/ip firewall layer7-protocol
add comment="DNS Nat contoso.com" name=contoso.com regexp="\\x07contoso\\x03com"
/ip firewall mangle
add action=mark-packet chain=prerouting comment="mark dns contoso.com" dst-address-type=local dst-port=53 in-interface-list=DNSMASQ layer7-protocol=contoso.com new-packet-mark=dns-contoso.com passthrough=yes protocol=udp
add action=mark-packet chain=prerouting comment="mark dns contoso.com" dst-address-type=local dst-port=53 in-interface-list=DNSMASQ layer7-protocol=contoso.com new-packet-mark=dns-contoso.com passthrough=yes protocol=tcp
/ip firewall nat
add action=dst-nat chain=dstnat comment="DST-NAT dns contoso.com" dst-port=53 in-interface-list=DNSMASQ packet-mark=dns-contoso.com protocol=udp to-addresses=192.0.2.15
add action=dst-nat chain=dstnat comment="DST-NAT dns contoso.com" dst-port=53 in-interface-list=DNSMASQ packet-mark=dns-contoso.com protocol=tcp to-addresses=192.0.2.15
add action=masquerade chain=srcnat comment="mask dns contoso.com" dst-port=53 packet-mark=dns-contoso.com protocol=udp
add action=masquerade chain=srcnat comment="mask dns contoso.com" dst-port=53 packet-mark=dns-contoso.com protocol=tcp
And this is not all, now you can register several forwarders, which will help make dns failover.Intelligent DNS processing will enable you to start implementing ipv6 in your company network. Before that I did not do this, the reason is that I needed to resolve a number of dns names to local addresses, and in ipv6 this could not be done without quite large crutches.