mirror.MikroTik/pothi.mikrotik-scripts
1
0
Fork 0
mirror of https://github.com/pothi/mikrotik-scripts.git synced 2025-06-24 23:18:38 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add alternative Cloudflare DoH script

Browse source
This commit is contained in:
Pothi Kalimuthu 2025-06-02 06:47:02 +05:30
parent 4d444a66bd
commit 60e720b7a5
No known key found for this signature in database
GPG key ID: 57069303D36E3093
4 changed files with 54 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
doh-scripts/README.md
View file

@ -3,10 +3,15 @@ The following DoH services can be automated for now...
- [Cloudflare](https://github.com/pothi/mikrotik-scripts/blob/main/doh-scripts/cloudflare.rsc)
- [Google](https://github.com/pothi/mikrotik-scripts/blob/main/doh-scripts/google.rsc)
- [NextDNS](https://github.com/pothi/mikrotik-scripts/blob/main/doh-scripts/nextdns.rsc)
Incompatible / buggy implementation...
- [Quad9](https://github.com/pothi/mikrotik-scripts/blob/main/doh-scripts/quad9.rsc)
Or you may use the [generic script](https://github.com/pothi/mikrotik-scripts/blob/main/doh-scripts/generic.rsc).
Officially incompatible DoH servers... https://help.mikrotik.com/docs/spaces/ROS/pages/37748767/DNS#DNS-Knowncompatible/incompatibleDoHservices
Relevant thread in MikroTik forums... https://forum.mikrotik.com/viewtopic.php?f=2&t=160243#p799274
Remember that DoH depends on the correct time on your MikroTik device. So, make sure that the NTP client is configured and is working. The MikroTik's Cloud NTP client service requires a working DNS that in turn requires a working NTP client. So, please don't depend on MikroTik's Cloud NTP sync service.

0
doh-scripts/cloudflare.rsc → doh-scripts/cloudflare-1.1.1.1.rsc
View file

36
doh-scripts/cloudflare-one.one.one.one.rsc Normal file
View file

@ -0,0 +1,36 @@
# Verify the connection at https://1.1.1.1/help
# disable doh (temporarily)
/ip dns set verify-doh-cert=no
# update the caCertURL depending on what's used at https://1.1.1.1/dns-query
:local caCertURL https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem
:local result [ /tool fetch url=$caCertURL dst-path=cert.pem as-value ];
:do { :delay 2s } while=( $result->"status" != "finished" )
/certificate remove [find name~"cert.pem"]
/certificate import file-name=cert.pem passphrase=""
# no longer needed for RouterOS v7
# /file remove cert.pem
# Add static DNS entries for the DoH server
/ip dns static remove [find name=one.one.one.one]
# use the following two entries only if IPv6 is available on your internet
# /ip dns static add address=2606:4700:4700::1111 name=one.one.one.one
# /ip dns static add address=2606:4700:4700::1001 name=one.one.one.one
/ip dns static add address=1.1.1.1 name=one.one.one.one
/ip dns static add address=1.0.0.1 name=one.one.one.one
/ip dns set use-doh-server=https://one.one.one.one/dns-query verify-doh-cert=yes
# optional steps
# use the following only if IPv6 is available on your internet
# /ip dns set servers="2606:4700:4700::1111,2606:4700:4700::1001,1.1.1.1,1.0.0.1"
/ip dns set servers="1.1.1.1,1.0.0.1"
/ip dhcp-client set use-peer-dns=no [find]
# flush existing cache
/ip dns cache flush

14
scripts/init.rsc
View file

@ -33,7 +33,7 @@
/system script
:local commonScripts {"backup-buttons"; "backup-cron"; "backup-scripts"; "cloud-backup"; "firmware-check"}
:local commonScripts {"cloud-backup"; "firmware-check"}
:local initScripts ("wifi-enable", $commonScripts)
:foreach scriptName in $initScripts do={
@ -41,4 +41,16 @@
:delay 30s
}
:local currentHour [:tonum [:pick [/system clock get time] 0 2]]
:if ($currentHour < 12) do={
:local backupScripts {"backup-cron"; "backup-scripts"}
:foreach scriptName in $backupScripts do={
:do { run $scriptName } on-error={:log error "Error running $scriptName"}
:delay 30s
}
} else={
:log info "Automated backups aren't taken after 12 noon."
}
:log info "Init script ended."