MikroTik DNS-over-HTTPS via Google.DNS 8.8.8.8

RouterOS 6.47 is just out with the new great DNS-over-HTTPS feature (DoH).

MikroTik can now protect your online activity by encrypting your DNS traffic.

DNS over HTTPS is a protocol for performing remote Domain Name System resolution via the HTTPS protocol. A goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks by using the HTTPS protocol to encrypt the data between the DoH client and the DoH-based DNS resolver. Wikipedia

This code will switch your MikroTik router to use Google DNS-over-HTTPS DoH servers and makes a transparent-dns-proxy for all unencrypted UDP 53 traffic for your LAN network.

Apply this script on your test router with default configuration first!

Download and install GlobalSignRoot CA certificate

/tool fetch https://pki.goog/gsr2/GSR2.crt check-certificate=no
/certificate import file-name="GSR2.crt" passphrase="" name="GlobalSignRootCAR2.crt"

Set static DNS records for dns.google name

/ip dns static add type=A address=8.8.8.8 name=dns.google ttl=1h
/ip dns static add type=A address=8.8.4.4 name=dns.google ttl=1h
/ip dns static add type=AAAA address=2001:4860:4860::8888 name=dns.google ttl=1h
/ip dns static add type=AAAA address=2001:4860:4860::8844 name=dns.google ttl=1h

Change DNS servers

/ip dns set servers=
/ip dns set use-doh-server="https://dns.google/dns-query" verify-doh-cert=yes

Transparent proxy all DNS queries from your LAN through your router towards DoH servers / put this rule on top

/ip firewall nat add chain=dstnat protocol=udp dst-port=53 in-interface-list=LAN action=redirect comment="Transparent proxy all DNS queries from your LAN"

Full script MikroTik-DOH-GoogleDNS.rsc

## Google DNS-over-HTTPS DoH script
## Apply this script on your default configuration LAB router first
## RouterOS 6.47++
## Credits Nikita Tarikin <nikita@tarikin.com>
## 03.06.2020

# Check for valid installed certificate
:do {
    :do {/tool fetch https://pki.goog/gsr2/GSR2.crt check-certificate=no} \
        while=([/file print count-only where name="GSR2.crt"]=0);
    :do {/certificate import file-name="GSR2.crt" passphrase="" name="GlobalSignRootCAR2.crt"} \
        while=([/certificate print count-only where name="GlobalSignRootCAR2.crt"]=0);
    :do {
        # Set static DNS records for dns.google name
        /ip dns static add type=A address=8.8.8.8 name=dns.google ttl=1h
        /ip dns static add type=A address=8.8.4.4 name=dns.google ttl=1h
        /ip dns static add type=AAAA address=2001:4860:4860::8888 name=dns.google ttl=1h
        /ip dns static add type=AAAA address=2001:4860:4860::8844 name=dns.google ttl=1h

        # Change DNS servers
        /ip dns set servers=
        /ip dns set use-doh-server="https://dns.google/dns-query" verify-doh-cert=yes

        # Transparent proxy all DNS queries from your LAN through your router towards DoH servers / put this rule on top
        :do {/ip firewall nat add chain=dstnat protocol=udp dst-port=53 in-interface-list=LAN action=redirect comment="Transparent proxy all DNS queries from your LAN"} \
            if=([/ip dns get allow-remote-requests]=yes)
    } while=([/certificate print count-only where fingerprint="ca42dd41745fd0b81eb902362cf9d8bf719da1bd1b1efc946f5b4c99f42c1b9e"]=0);
} if=([/certificate print count-only where name="GlobalSignRootCAR2.crt"]=0);

Full list of well-known DNS-over-HTTPs service providers in this list

https://github.com/curl/curl/wiki/DNS-over-HTTPS

MikroTik DNS-over-HTTPS via Google.DNS 8.8.8.8

Apply this script on your test router with default configuration first!

Report Page