MikroTik Tutorial 63 - Prevent users from changing their DNS

[@iconnectbymvgozalo6416]

Thank you very much! Very straight to the point tutorials.

[@dffabryr]

Your tutorials are very useful and effective. Thank you very much !!

[@franzlestermeusebio3186]

Thank you for this tutorial, is really works to me.

[@mahmoudegypt17]

Your tutorials are very useful

[@adammostafa5426]

is there an alternative way for zte router ?? . and thanke you for you amazing tutorials

[@hazartilirot1014]

The tip is useful. I can force users to force my inner DNS server but what should be done provided the DNS server at the same subnet - it cannot resolve host :D

[@brotheradamfromups]

How do I get this to work running a local pihole DNS that blocks certain domains and forwards all other requests to google dns?

[@hijackthat974]

this is so good, however can you tell us how to block users that use DoT or DoH?

[@shokowillard]

Great tutorial keep up the great work. May you please add tutorial for different wireless modes (station,station pseudobridge,pseudobridge clone, station wds,nstreme dual slave etc)

[@TKSJa]

Adding to my list.

[@nexuspro183]

Really amazing series dude

[@derrickt.za1564]

Can you please do a tutorial on user manager 7.1.2 version. I cannot get user to connect to the internet. Thank You

[@kevinmiole]

how to you add alternate dns? separate addresses with what?

[@grimpr]

Thanks, how do you redirect to the local mikrotik dns server that forwards to opendns?

[@jotne]

Instead of setting Action: dst-nat, use Action: redirect and set To Port: 53. This will redirect all UDP:53 request to local DNS.

[@JaZzDeOliveira]

Hi , how do I get this to work when running multiple Mikrotik Hotspots? I have two seperate hotspots. 1 is for guest and 1 is for kids. I have set a different DNS for each subnet. But after users sign in on the login page, I see that all DNS queries are sent to the DNS set on the Mikrotik router and even with the above NAT rule specifying to go external DNS. All DNS queries are still going to the Router DNS and not to the set DNS. Any suggestions on how to fix this, as the issue only occurs when using Hotspot.

[@challenger5775]

its very useful. great tutorials.

[@TKSJa]

Thanks

[@spiritcore1]

Very useful, thank you! Do you know why it blocks ping from my PC? Everything works OK but I can't ping when the rule is enabled...

[@JaZzDeOliveira]

This rule does not seem to work anymore, any suggestions with the new routeros version

[@richardayuyang632]

How about multiple redirections to multiple DNS, I have 2 piholes in my network. TIA

[@SpikeHome]

great tutotrial, but kan i also force users to use my local dns cache server at my mikrotik router?

[@TKSJa]

yes, just change the IP to your dns IP.

[@ncduong]

Hello, I install AdguardHome on RasPi, AdGuardHome DNS uses port 53 to listen. Unfortunately port 53 is also being used by Router Mikrotik's Hostspot service. How can I fix it? :(

[@amieka7454]

Can I use this rule for multiple DNS ?

[@TheRashyyd]

My net stops browsing the minute I apply this changes, can you guess what could be the problem?

[@RaviPatel-fq8lq]

hi i want to Force users to use specified our DNS server on mikrotik can we use the rule

[@stevesmith2553]

can you do one on layer 3 switching ., routing on a layer 3 switch --- ty

[@TKSJa]

Noted

[@MaestroDJDaniello]

Awesome, thanks

[@dangdut1]

hello sir I want to ask if you not mind about rule for extension video download on layer7 can you tell us ?? I use rb952.. many tutorial i try can't recognize in winbox.. the mangle packet still zero

[@TKSJa]

Check the interfaces that you are using in your mangle rules.

[@potskie3704]

Hi, i just want to know if mikrotik can also prevent user to share their internet to other wifi devices.

[@TKSJa]

It all depends on how your network is configured. Based on my experience this might not be preventable.

[@kazimriaz8319]

very helpful can you tell me the model of this device ?

[@TKSJa]

Don't remember, all Mikrotik routers can do this

[@dennytobing]

how about with 2 ISP Connection ?

[@TKSJa]

Create a rule for each connection.

[@maltew7653]

What should i do if i want to force everyone trough a pihole dns , expect the raspberry pi , so pihole can forward passed trafic trough another dns like: 9.9.9.9

[@TKSJa]

Create an exception in the rule for that address.

[@maltew7653]

TKSJa OK thanks...if the DNServer , in my case pihole is on the local lan can i do the setup like shown in the Video or should i use another nat action?

[@DolcheGuevara]

You haven`t show us what happent if someone change DNS in network settings.

[@JoshSmeda]

Won't affect client side. The masquerade rule will redirect DNS traffic to the destination you specified in the rule. If you want to enforce client side, setup a group policy. This is a workaround for a non AD environment.

[@johnlohan9900]

Please tell me why it is important to do this ?

[@TKSJa]

Content filtering and security.

[@dukedblu]

nice!

No alternate DNS?

[@TKSJa]

No, you set yours

[@obslugait88]

@@TKSJa What if I use router DNS and Cache?

[@rodrickingram8731]

@@obslugait88 You could

[@redheart419]

Isn't it illegal when ISP doing this?

[@TKSJa]

No sure, but for hotspot, business, school or home this is ok to do.

[@redheart419]

+TKSJa I'm talking about residential broadband provider

[@redheart419]

+TKSJa it's acceptable for school, businesses and Hotspot... But when residential broadband provider does this, it pisses off some advance users

[@TKSJa]

That's true

[@AndrewTaranovND]

Thnx!

[@ahmdnaube3745]

After this setup what if a client uses his Android to install a VPN app and connect that APP then he can browse porn? Am i right?

[@usmanjutt7908]

Hlow sir i say again How to limit dwonlad extenshion mkv mp4 and etc😆😊☺

[@TKSJa]

Added to my list.

[@ArmanHAlam]

Firewall / NAT rule for forcing use of google isnt wokring