Routeros limited DNS hijacking and check

scene ：

The intranet is built inside dns, The development will have some internal domain names to resolve, generally inner*.domain.com, The requirement is first analyzed on the intranet , There is no normal parsing of the external network .

Design description ：

Because the domain names that need this function are limited , The principle of minimum impact is only applicable to *.domain.com Conduct dns hijacked ;

To configure :

step1：layer7 dns Identify the configuration

You can use regular matching to match more domain names such as .domain.com|.domain2.com

Log in and copy

      
      

       
       /ip firewall layer7-protocol add name=inner_dns regexp=.domain.com
      
      
      
      

       
       
1.
      
      

step2: Turn on routeros Of dns function

Intranet dns server= 192.168.23.56

Log in and copy

      
      

       
       /ip dns set allow-remote-requests=yes query-server-timeout=5s servers=192.168.23.56
      
      
      
      

       
       
1.
      
      

step3: add to dns hijacked , take step1 The identified request is forwarded to routeros Of 53 On port

Conditions layer7=inner_dns&&udp&&dstPort=53&&not innerdns

Log in and copy

      
      

       
       /
       
       ip 
       
       firewall 
       
       nat
       
       

       
       add 
       
       action
       
       =
       
       redirect 
       
       chain
       
       =
       
       dstnat 
       
       comment
       
       =
       
       "hack dns" 
       
       dst
       
       -
       
       address
       
       -
       
       type
       
       =!
       
       local 
       
       \
       
       
    
       
       dst
       
       -
       
       port
       
       =
       
       53 
       
       layer7
       
       -
       
       protocol
       
       =
       
       inner_dns 
       
       protocol
       
       =
       
       udp 
       
       src
       
       -
       
       address
       
       =
       
       \
       
       
    
       
       !
       
       192.168
       
       .23
       
       .56 
       
       src
       
       -
       
       address
       
       -
       
       type
       
       =!
       
       local 
       
       to
       
       -
       
       ports
       
       =
       
       53
      
      
      
      

       
       
1.
       
       
2.
       
       
3.
       
       
4.
      
      

Just put it simply .......

Add a beautiful thing to a contrasting beautiful thing ：

Check Intranet dns, If it cannot be resolved, close the hijacking , Once recovered, start hijacking , Intranet required dns There is one that won't fail A Record

step1：script Script -- according to dns Whether it can be parsed for opening and closing

cDomain domain name

cDomainOk Correct parsing record

dnsServer Intranet dns Server address

Log in and copy

      
      

       
       /
       
       system 
       
       script
       
       

       
       add 
       
       dont
       
       -
       
       require
       
       -
       
       permissions
       
       =
       
       no 
       
       name
       
       =
       
       check_hack_dns 
       
       owner
       
       =
       
       admin 
       
       policy
       
       =
       
       \
       
       
    
       
       ftp,
       
       reboot,
       
       read,
       
       write,
       
       policy,
       
       test,
       
       password,
       
       sniff,
       
       sensitive,
       
       romon 
       
       source
       
       =
       
       ":local cD\
       
       
    
       
       omain f.chuangcache.com\r\
       
       
    
       
       \n:local cDomainOk 192.168.11.53\r\
       
       
    
       
       \n:local dnsServer 192.168.23.56\r\
       
       
    
       
       \n:local isDisabled null\r\
       
       
    
       
       \n:local dnsCheck null\r\
       
       
    
       
       \n\r\
       
       
    
       
       \n:do { :set isDisabled [/ip firewall nat get [find comment=\"hack dns\"] disabled\
       
       
    
       
       ] } on-error={set isDisabled \"error\";:log info \"firewall not found! \";:quit;};\
       
       
    
       
       \r\
       
       
    
       
       \n\r\
       
       
    
       
       \n:do { :set dnsCheck [:resolve server=\$dnsServer domain-name=\$cDomain ] } on-er\
       
       
    
       
       ror={set dnsCheck \"error\"};\r\
       
       
    
       
       \n\r\
       
       
    
       
       \n\r\
       
       
    
       
       \n\r\
       
       
    
       
       \n# turn on dns hack if check ok\r\
       
       
    
       
       \n:if (\$isDisabled=true and \$dnsCheck=\$cDomainOk ) do={ /ip firewall nat set \
       
       
    
       
       [find comment=\"hack dns\"] disabled=no; :log info \"hack dns is enabled\" }\r\
       
       
    
       
       \n\r\
       
       
    
       
       \n# turn off dns hack when check error\r\
       
       
    
       
       \n:if (\$isDisabled=false and \$dnsCheck=\"error\" ) do={ /ip firewall nat set [fi\
       
       
    
       
       nd comment=\"hack dns\"] disabled=yes; :log info \"hack dns is disabled , check= \
       
       
    
       
       \$dnsCheck\" ; }\r\
       
       
    
       
       \n\r\
       
       
    
       
       \n# \r\
       
       
    
       
       \n:if (\$isDisabled=true and \$dnsCheck=\"error\") do={:log info \"local dns serve\
       
       
    
       
       r down : \$dnsServer\"} "
      
      
      
      

       
       
1.
       
       
2.
       
       
3.
       
       
4.
       
       
5.
       
       
6.
       
       
7.
       
       
8.
       
       
9.
       
       
10.
       
       
11.
       
       
12.
       
       
13.
       
       
14.
       
       
15.
       
       
16.
       
       
17.
       
       
18.
       
       
19.
       
       
20.
       
       
21.
       
       
22.
       
       
23.
       
       
24.
       
       
25.
       
       
26.
       
       
27.
       
       
28.
       
       
29.
       
       
30.
      
      

It's not good-looking. Have a neat ：

Log in and copy

      
      

       
       :
       
       local 
       
       cDomain 
       
       f.
       
       domain.
       
       com
       
       
:
       
       local 
       
       cDomainOk 
       
       192.168
       
       .11
       
       .53
       
       
:
       
       local 
       
       dnsServer 
       
       192.168
       
       .23
       
       .56
       
       
:
       
       local 
       
       isDisabled 
       
       null
       
       
:
       
       local 
       
       dnsCheck 
       
       null
       
       

       
       
:
       
       do { :
       
       set 
       
       isDisabled [
       
       /
       
       ip 
       
       firewall 
       
       nat 
       
       get [
       
       find 
       
       comment
       
       =
       
       "hack dns"] 
       
       disabled] } 
       
       on
       
       -
       
       error
       
       ={
       
       set 
       
       isDisabled 
       
       "error";:
       
       log 
       
       info 
       
       "firewall not found! ";:
       
       quit;};
       
       

       
       
:
       
       do { :
       
       set 
       
       dnsCheck [:
       
       resolve 
       
       server
       
       =
       
       $dnsServer 
       
       domain
       
       -
       
       name
       
       =
       
       $cDomain ] } 
       
       on
       
       -
       
       error
       
       ={
       
       set 
       
       dnsCheck 
       
       "error"};
       
       

       
       

       
       

       
       

       
       # 
       
       turn 
       
       on  
       
       dns 
       
       hack 
       
       if 
       
       check 
       
       ok
       
       
:
       
       if (
       
       $isDisabled
       
       =
       
       true 
       
       and 
       
       $dnsCheck
       
       =
       
       $cDomainOk )   
       
       do
       
       ={ 
       
       /
       
       ip 
       
       firewall 
       
       nat 
       
       set [
       
       find 
       
       comment
       
       =
       
       "hack dns"] 
       
       disabled
       
       =
       
       no;  :
       
       log 
       
       info 
       
       "hack dns is enabled" }
       
       

       
       

       
       # 
       
       turn 
       
       off 
       
       dns 
       
       hack 
       
       when 
       
       check 
       
       error
       
       
:
       
       if (
       
       $isDisabled
       
       =
       
       false 
       
       and 
       
       $dnsCheck
       
       =
       
       "error" ) 
       
       do
       
       ={ 
       
       /
       
       ip 
       
       firewall 
       
       nat 
       
       set [
       
       find 
       
       comment
       
       =
       
       "hack dns"] 
       
       disabled
       
       =
       
       yes; :
       
       log 
       
       info 
       
       "hack dns is disabled , check= $
       
       dnsCheck
       
       " ; }
       
       

       
       

       
       # 
       
       
:
       
       if (
       
       $isDisabled
       
       =
       
       true 
       
       and 
       
       $dnsCheck
       
       =
       
       "error") 
       
       do
       
       ={:
       
       log 
       
       info 
       
       "local dns server down : $
       
       dnsServer
       
       "} 
      
      
      
      

       
       
1.
       
       
2.
       
       
3.
       
       
4.
       
       
5.
       
       
6.
       
       
7.
       
       
8.
       
       
9.
       
       
10.
       
       
11.
       
       
12.
       
       
13.
       
       
14.
       
       
15.
       
       
16.
       
       
17.
       
       
18.
       
       
19.
       
       
20.
      
      

step2： Add timing task 1 Check every minute

on-event Just fill in script Of name

Log in and copy

      
      

       
       /
       
       system 
       
       scheduler
       
       

       
       add 
       
       interval
       
       =
       
       1
       
       m 
       
       name
       
       =
       
       "do local dns check" 
       
       on
       
       -
       
       event
       
       =
       
       check_hack_dns 
       
       policy
       
       =
       
       \
       
       
    
       
       ftp,
       
       reboot,
       
       read,
       
       write,
       
       policy,
       
       test,
       
       password,
       
       sniff,
       
       sensitive,
       
       romon 
       
       start
       
       -
       
       date
       
       =
       
       \
       
       
    
       
       jul
       
       /
       
       28
       
       /
       
       2022 
       
       start
       
       -
       
       time
       
       =
       
       20:
       
       44:
       
       28
      
      
      
      

       
       
1.
       
       
2.
       
       
3.
       
       
4.
      
      

end：

Rough 、 The details have not been worked out