Mikrotik Script - No Internet for Manually Configured DNS

To restrict DHCP clients from connecting to the internet if they manually input DNS settings, you can configure your MikroTik router to enforce DNS settings through DHCP. This ensures that DNS configuration is obtained automatically from the DHCP server. Follow these steps using the WinBox interface:

Access WinBox:

Connect to your MikroTik router using the WinBox application.
Go to IP > DHCP Server:

In the left menu, navigate to IP and then click on DHCP Server.
Select Your DHCP Server:

Choose the DHCP server that is providing IP addresses to the clients.
Configure DNS Settings:

In the DHCP Server settings, there should be an option for "Use Peer DNS." Ensure this option is enabled. This option tells the DHCP server to provide DNS settings received from the ISP (Internet Service Provider) rather than static DNS settings.
Limit DNS Access:

To prevent clients from manually configuring DNS settings, you can restrict outgoing DNS traffic from your network except through the DNS servers provided by the DHCP server. You can create a firewall rule for this purpose.

In the left menu, navigate to IP and then click on Firewall.

Add a new rule to block DNS traffic going to any DNS server except those provided by your DHCP server.

plaintext
Copy code
/ip firewall filter
add chain=forward action=drop protocol=udp dst-port=53 out-interface=!your_WAN_interface
add chain=forward action=drop protocol=tcp dst-port=53 out-interface=!your_WAN_interface
Replace your_WAN_interface with the actual name of your WAN (Internet-facing) interface.

Update Configuration:

After making these changes, make sure to click "Apply Configuration" to save the changes.
Please note that implementing such restrictions might impact legitimate configurations or user preferences. Ensure that your network users are informed of any changes, and consider implementing such restrictions only if necessary for security or policy reasons.