When you configure a MikroTik edge router to function as a DNS cache, it is crucial to consider the security implications and visibility from the WAN (Wide Area Network).

Here are some key points about how these settings can affect the security and visibility of your router:

Increased Visibility and Vulnerability

1. Major Exhibition: By activating a DNS service on your MikroTik router that is accessible from the WAN, you effectively increase the attack surface. Attackers may attempt to exploit vulnerabilities in the DNS service or use it for DNS amplification attacks if it is not properly configured and secured.
2. DDoS attacks: One of the risks associated with having a DNS server accessible from the WAN is that it can be used in DDoS reflection and amplification attacks. This occurs when an attacker sends small requests to the DNS server with a spoofed IP address (the IP address of the attack target), causing the DNS server to send much larger responses to the target, overloading its resources.
3. Possible Data Leaks: If the DNS cache is not configured to limit who can make queries, you could end up providing information about the queried domains to anyone who makes the request, which could be an unintentional data leak.

Security measures

To mitigate these risks and protect your MikroTik router when used as a DNS cache, consider implementing the following security measures:

1. Access Restriction: Configure rules on your firewall to allow only your internal users (your local network) to access the DNS cache. Blocks all incoming DNS requests from the WAN.
2. Rate Limiting: Implements rate limiting on DNS requests to prevent server abuse, reducing the effectiveness of DDoS attacks.
3. DNSSEC: Consider using DNSSEC (DNS Security Extensions) to add a layer of security by validating DNS responses, thus protecting against cache poisoning attacks.
4. Monitoring and Records: Keep a log and actively monitor DNS traffic to detect abnormal patterns that could indicate an attempted attack or misuse of the DNS server.
5. Regular Updates: Make sure your MikroTik router is always updated with the latest firmware and security patches to protect against known vulnerabilities.

Conclusion

While using a MikroTik router as a DNS cache can increase visibility and potentially vulnerability from the WAN, implementing appropriate security measures and restrictive configurations can help mitigate these risks and ensure that the DNS server operates securely and efficiently.