University of Babylon, IT College Information Network Dep., Third Class, Second Semester MTCNA Course MikroTik Certified Network Associate 2015-2016 By M.Sc. I.T Alaa A. Mahdi • DNS AND DST-NAT • ADDRESS-LIST DST-NAT Example DNS and DST-NAT Force users to use specified DNS server This is just simple firewall rule which will force all Your users behind RB to use DNS server which You will define. This rule will force all users with custom defined DNS server to use 192.168.88.1 as their DNS server, this rule will simply redirect all request sent to ANY-IP:53 to 192.168.88.1:53 /ip firewall filter nat add chain=dstnat protocol=tcp dst-port=53 action=dst-nat to-addresses=192.168.88.1 to-ports=53 add chain=dstnat protocol=udp dst-port=53 action=dst-nat to-addresses=192.168.88.1 toports=53 Address-List Firewall address lists allow to create a list of IP addresses to be used for packet matching. Firewall address lists allow user to create lists of IP addresses grouped together. Firewall filter, mangle and NAT facilities can use address lists to match packets against them. Creating an Address List Name - specify the name of the address list to add IP address to. address (IP address/netmask | IP address-IP address) - specify the IP address or range to be added to the address list. Example Address List Sometimes, in MT logs, you will see that some IPs from WAN/LAN try to login to your MT box using SSH, Winbox, etc. To secure your router, the best solution would be to come up with a list of networks that should be allowed to access the router administratively, and block everything else. The address list records could be updated dynamically via the action=add-src-to-address-list or action=add-dst-to-address-list • add-dst-to-address-list - add destination address to address list specified by addresslist parameter . • add-src-to-address-list - add source address to address list specified by addresslist parameter . address-list (string; Default: ) Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list address-list-timeout (time; Default: 00:00:00) Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-toaddress-list actions Value of 00:00:00 will leave the address in the address list forever .