How to block DNS resolution from outside in Mikrotik

It is very important to block the DNS service (port 53), for incoming connections, on your Router/Firewall, in order to increase security and avoid cyber attacks, such as DDOS. To do this, connect to your MikroTik, for example, using Winbox, and run the following commands from the Terminal:

» /ip firewall filter » add chain=input in-interface=IN-INT protocol=udp dst-port=53 action=drop » add chain=input in-interface=IN-INT protocol=tcp dst-port=53 action=drop » /ip firewall filter » add chain=forward in-interface=IN-INT protocol=udp dst-port=53 action=drop » add chain=forward in-interface=IN-INT protocol=tcp dst-port=53 action=drop PLEASE NOTE: Replace IN-INT with the name of your Mikrotik's WAN interface. IMPORTANT: If you use multiple WAN interfaces (multi-WAN scenario) in your Mikrotik, you must re-run the above commands, replacing IN-INT with the names of the other WAN interfaces.

Other ways to ask: » How to block DNS resolution from outside. » Blocking DNS resolution from outside. How to.