#10 Acabo de encontrar una manera mas sencilla sin tanta sobreingenieria. Te lo comparto porque lo he probado y me funciona correctamente.
Escenario de pruebas:
WAN: whatever
LAN: 192.168.3.0/24
GW: 192.168.3.1
PI-Hole: 192.168.3.34
DNS:
/ip dns
set allow-remote-requests=yes
DHCP-Server
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridge1 name=dhcp1
/ip dhcp-server network
add address=192.168.3.0/24 dns-server=192.168.3.1 gateway=192.168.3.1
NAT:
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.3.0/24
add action=dst-nat chain=dstnat comment=Blocky dst-address-list=LANs dst-port=53 protocol=tcp src-address-list=LANs to-addresses=192.168.3.34
add action=dst-nat chain=dstnat comment=Blocky dst-address-list=LANs dst-port=53 protocol=udp src-address-list=LANs to-addresses=192.168.3.34
add action=masquerade chain=srcnat comment="Hairpin NAT" connection-mark="Hairpin NAT
Mangle:
/ip firewall mangle
add action=mark-connection chain=prerouting comment="Marcamos conexiones para hairpin NAT - LAN IP" dst-address-list=LANs new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LANs
Address list:
/ip firewall address-list
add address=192.168.3.0/24 list=LANs
Script:
/system scheduler
add interval=10s name=schedule1 on-event="# Specify search filters for NAT rules\r\
\n:local tcpRuleId [/ip firewall nat find comment=\"Blocky\" protocol=\"tcp\"]\r\
\n:local udpRuleId [/ip firewall nat find comment=\"Blocky\" protocol=\"udp\"]\r\
\n\r\
\n# Find Blocky IP from NAT rule\r\
\n:local toAddresses [/ip firewall nat get \$tcpRuleId to-addresses]\r\
\n\r\
\n# Specify query domain\r\
\n:local queryDomain \"www.google.com\"\r\
\n\r\
\n:if ([/ip firewall nat get \$tcpRuleId disabled] = false) do={\r\
\n :do {\r\
\n :resolve \$queryDomain server=\$toAddresses\r\
\n } on-error={\r\
\n /ip firewall nat set \$tcpRuleId disabled=yes\r\
\n /ip firewall nat set \$udpRuleId disabled=yes\r\
\n }\r\
\n} else={\r\
\n :do {\r\
\n :resolve \$queryDomain server=\$toAddresses\r\
\n /ip firewall nat set \$tcpRuleId disabled=no\r\
\n /ip firewall nat set \$udpRuleId disabled=no\r\
\n } on-error={}\r\
\n}" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=sep/10/2024 start-time=13:34:24
Solo el codigo:
# Specify search filters for NAT rules
:local tcpRuleId [/ip firewall nat find comment="Blocky" protocol="tcp"]
:local udpRuleId [/ip firewall nat find comment="Blocky" protocol="udp"]
# Find Blocky IP from NAT rule
:local toAddresses [/ip firewall nat get $tcpRuleId to-addresses]
# Specify query domain
:local queryDomain "www.google.com"
:if ([/ip firewall nat get $tcpRuleId disabled] = false) do={
:do {
:resolve $queryDomain server=$toAddresses
} on-error={
/ip firewall nat set $tcpRuleId disabled=yes
/ip firewall nat set $udpRuleId disabled=yes
}
} else={
:do {
:resolve $queryDomain server=$toAddresses
/ip firewall nat set $tcpRuleId disabled=no
/ip firewall nat set $udpRuleId disabled=no
} on-error={}
}
Con este sistema se simplifica un poco mas el sistema de verificacion del contenedor. Aqui el equipo mikrotik verifica si puede resolver con PiHole, en caso de no ser así deshabilita el NAT y resuelve contra las DNS dinamicas que tenga mikrotik.
El script en cuanto detecta que puede resolver nuevamente contra pihole habilitara el NAT y resolveran tus equipos con PiHole.
