Open DNS resolver: your router answers DNS queries from the whole internet

What the audit found

The router has Allow Remote Requests switched on under IP → DNS, which turns it into a DNS resolver for anything that can reach it, and no active firewall rule blocks DNS traffic (UDP port 53) arriving on the WAN interface. In other words, the router will happily resolve names for anyone on the internet, not just for your own devices.

The audit reports this as high severity on a router with a WAN interface where the port is reachable from outside. The same setting behind a working input firewall is not a problem at all — it is the normal way to give your LAN a local DNS cache.

Why it matters

The risk here is not that someone reads your data. It is that your router becomes a weapon against other people, and you pay for it.

DNS runs over UDP, which means the sender's address is not verified. An attacker sends your router a small DNS query with the victim's address forged as the source. Your router looks up the answer and sends a much larger reply — to the victim. Multiply that by thousands of open resolvers and the attacker has a DNS amplification attack: a few megabits of forged queries turned into gigabits of traffic hitting the target.

For you, the consequences are practical. Your uplink saturates while the attack runs, so your own internet slows down or stops. Your public address ends up on abuse lists. Many ISPs actively scan for open resolvers on their network and will throttle or disconnect the customer, sometimes without much warning. Automated scanners find open resolvers within hours of them appearing online, so this is not a theoretical exposure.

The router's resolver also becomes another service that anyone can poke at for bugs, but the amplification abuse is the main issue.

What it looks like in Winbox

Open IP → DNS. The Allow Remote Requests checkbox will be ticked. That is fine in itself — it is what makes the router a DNS cache for your LAN.

Then open IP → Firewall → Filter Rules and look at the input chain. If there is no rule that drops traffic arriving on your WAN interface (either a general drop or one specifically for port 53), the resolver is reachable from outside.

How to fix it

Keep the resolver for your LAN and simply stop the internet from reaching it. The preferred fix is the general input rule that every router should have anyway: a rule at the end of the input chain under IP → Firewall → Filter Rules that drops all unsolicited traffic not arriving from an interface in your LAN interface list, placed after your accept rules for established and related connections and for ICMP. This one rule protects the resolver and every other service on the router at once, which is why this finding rarely appears alone.

If you would rather target DNS only — because your input chain is built differently — the alternative is a pair of drop rules matching port 53 on the WAN interface list, one for UDP (normal queries) and one for TCP (large responses and zone transfers), both above any rule that accepts everything.

Turning off Allow Remote Requests is also possible, but then your LAN devices lose the router as a DNS server and need to be pointed elsewhere. Filtering at the WAN is the cleaner solution. Use Safe Mode in Winbox while you add the rule: if the interface list is wrong and you lock yourself out, the router reverts the change when the session drops.

Afterwards, run a DNS lookup against your public address from outside your network — a phone on mobile data with a DNS lookup app is enough. It should time out, while the same query from the LAN is still answered. Then re-run the audit: the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

My LAN devices use the router as their DNS server. Will they lose it?

No. The fix blocks DNS only on the WAN side. Devices on the LAN reach the resolver through the LAN interface, which the rules do not touch. You do not need to change Allow Remote Requests.

I use the router's DNS from a VPN. Does that still work?

Yes, as long as the VPN interface is in your LAN interface list, or you add a specific accept rule for the VPN subnet above the drop. Traffic arriving through an established VPN tunnel is treated like any other internal interface.

Would changing the DNS port help instead?

No. DNS clients expect port 53 and the router does not offer a way to change it for its resolver anyway. Block the port from the WAN side; that is the only fix that both keeps the resolver working and stops the abuse.