Change the in-interface to "pppoe-out1" ?

# 1月/ 10/2023 15:13:32 Roul雷竞技terOS 7.6 #软件雷电竞app下载官方版苹果id = 7***-**** # # model = RB750 # serial number = 2F********** /interface pppoe-client add add-default-route=yes allow=pap disabled=no interface=ether1 name=\ pppoe-out1 use-peer-dns=yes user=testlogin@isp /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /ip dhcp-client add interface=ether1 /ip firewall filter add action=accept chain=input dst-port=53 in-interface=pppoe-out1 log=yes log-prefix=-mydns protocol=tcp add action=accept chain=input dst-port=53 in-interface=pppoe-out1 log=yes log-prefix=-mydns protocol=udp add action=accept chain=input in-interface=pppoe-out1 add action=accept chain=forward add action=accept chain=output add action=log chain=input dst-port=53 log-prefix="PORT 53 TCP HIT" protocol=tcp add action=log chain=input dst-port=53 log-prefix="PORT 53 UDP HIT" protocol=udp /ip firewall service-port set ftp disabled=yes set tftp disabled=yes set h323 disabled=yes set sip disabled=yes /ip service set telnet disabled=yes set ftp disabled=yes set www disabled=yes set ssh disabled=yes /system clock set time-zone-name=America/Toronto /system identity set name=TestTik /system leds add interface=pppoe-out1 leds="" type=interface-activity /system package update set channel=testing /system routerboard settings set boot-device=nand-only

Confusing post.
Forgetting about the config,
你有什么requirements, based on users, traffiic flow they need to have or not to have with respect to DNS.
A viable solution will pop out from well stated requirements.
The only issue here is that you dont understand how DNS works or ROS works or both............. and chasing a config is needlessly challenging without understanding the why.........

Ensure you add any network context like self supplied PI servers and where they reside.........

For starters, push those 2 rules with action=log above similar rules with action=accept. Firewall rules are evaluated top-to-bottom and first matching rule executes. Rules with action=accept or action=drop also stop processing of rules. So the way you have them now, the log rules will not execute for paxkets ingressing through PPPoE interface because matching packets trigger execution of accept rules above.

Does connection work from LAN? From firewall point of view either (LAN and PPPoE) should work, you actually don't have anything in firewall blocking any connection to router itself ... which also means device can be easily hacked from internet. So if connecting to DNS service on router works from LAN but doesn't from internet, then your ISP doesn't offer internet lines as transparrent as you were made to believe.

/ip firewall filter add action=log chain=input dst-port=53 in-interface=pppoe-out1 log-prefix=\ "PORT 53 TCP HIT" protocol=tcp add action=log chain=input dst-port=53 in-interface=pppoe-out1 log-prefix=\ "PORT 53 UDP HIT" protocol=udp add action=accept chain=input dst-port=53 in-interface=pppoe-out1 log=yes \ log-prefix=-mydns protocol=tcp add action=accept chain=input dst-port=53 in-interface=pppoe-out1 log=yes \ log-prefix=-mydns protocol=udp add action=accept chain=input in-interface=pppoe-out1 add action=accept chain=forward add action=accept chain=output

Why would anyone open up port 53 on the input chain or portforward port 53 to the LAN side.........
Sounds like security breach to me........

In other words your firewall rules are not worthy of commenting upon and port 53 is the least of your problems.


Fixed for you........
/ip firewall filter
{Input Chain}
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment="drop all else"
{forward chain}
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="allow internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow port forwarding" connection-nat-state=dstnat
add action=drop chain=forward
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface-list=WAN


Output chain is rarely needed and not included here.

YOu are missing many other components of a config and its no wonder nothing is working............

Open resolvers on port 53 are often abused for DDoS reflection attacks, your ISP or another upstream is probably filtering it.

Open resolvers on port 53 are often abused for DDoS reflection attacks, your ISP or another upstream is probably filtering it.

[…]accidently[…]