---
title: How to block DNS resolution from outside in Mikrotik
slug: legacy/how-to-block-dns-resolution-from-outside-in-mikrotik
description: Enhance your network security by learning how to block incoming DNS service connections on port 53 to mitigate cyber threats like DDoS attacks. 
docTags: 
createdAt: 2024-02-05T13:02:30.029Z
---

It is very important to block the *DNS service* (port 53), for incoming connections, on your *Router/Firewall*, in order to increase security and avoid cyber attacks, such as DDOS.

To do this, connect to your MikroTik, for example, using Winbox, and run the following commands from the Terminal:

- */ip firewall filter 
*
- *add chain=input in-interface=IN-INT protocol=udp dst-port=53 action=drop
*
- *add chain=input in-interface=IN-INT protocol=tcp dst-port=53 action=drop
*
- */ip firewall filter
*
- *add chain=forward in-interface=IN-INT protocol=udp dst-port=53 action=drop
*
- *add chain=forward in-interface=IN-INT protocol=tcp dst-port=53 action=drop*


  **PLEASE NOTE**: Replace IN-INT with the name of your Mikrotik's WAN interface.


**IMPORTANT**: If you use multiple WAN interfaces (multi-WAN scenario) in your Mikrotik, you must re-run the above commands, replacing IN-INT with the names of the other WAN interfaces.

**Other ways to ask**:

- How to block DNS resolution from outside.
- Blocking DNS resolution from outside. How to.