Пример условной пересылки клиентских запросов ДНС, проходящих через роутер к зоне
local и PTR для
192.168.x.x на
сервер 100.67.89.1100.67.89.1:
/ip firewall layer7-protocol add comment="for *.local" name=local \
regexp="\\\\x05local.\\\\x01"
/ip firewall layer7-protocol add comment="PTR for 192.168.x.x" \
name=ptr-192.168 \
regexp="168\\\\x03192\\\\x07in-addr\\\\x04arpa.\\\\x01"
/ip firewall mangle add action=mark-connection chain=prerouting \
comment="For DNS *.local" connection-mark=no-mark dst-port=53 \
layer7-protocol=local new-connection-mark=local-fwd \
passthrough=yes protocol=tcp
/ip firewall mangle add action=mark-connection chain=prerouting \
comment="For DNS *.local" connection-mark=no-mark dst-port=53 \
layer7-protocol=local new-connection-mark=local-fwd \
passthrough=yes protocol=udp
/ip firewall mangle add action=mark-connection chain=prerouting \
comment="For DNS 192.168 PTR" connection-mark=no-mark \
dst-port=53 layer7-protocol=ptr-192.168 \
new-connection-mark=local-fwd passthrough=yes protocol=udp
/ip firewall nat add action=dst-nat chain=dstnat \
comment="NAT for DNS" connection-mark=local-fwd \
in-interface-list=!WAN to-addresses=100.67.89.1
/ip firewall layer7-protocol add comment="for *.local" name=local \
regexp="\\\\x05local.\\\\x01"
/ip firewall layer7-protocol add comment="PTR for 192.168.x.x" \
name=ptr-192.168 \
regexp="168\\\\x03192\\\\x07in-addr\\\\x04arpa.\\\\x01"
/ip firewall mangle add action=mark-connection chain=prerouting \
comment="For DNS *.local" connection-mark=no-mark dst-port=53 \
layer7-protocol=local new-connection-mark=local-fwd \
passthrough=yes protocol=tcp
/ip firewall mangle add action=mark-connection chain=prerouting \
comment="For DNS *.local" connection-mark=no-mark dst-port=53 \
layer7-protocol=local new-connection-mark=local-fwd \
passthrough=yes protocol=udp
/ip firewall mangle add action=mark-connection chain=prerouting \
comment="For DNS 192.168 PTR" connection-mark=no-mark \
dst-port=53 layer7-protocol=ptr-192.168 \
new-connection-mark=local-fwd passthrough=yes protocol=udp
/ip firewall nat add action=dst-nat chain=dstnat \
comment="NAT for DNS" connection-mark=local-fwd \
in-interface-list=!WAN to-addresses=
100.67.89.1Возможно не делать пометку соединений, а сразу в правиле NAT указать необходимые условия, включая L7.