I think that the issue was most likely a UDP amplification attack. TCP isn’t susceptible in the same way so I suspect that you could leave TCP open and not have an issue.
Yes MikroTik can answer TCP ( I Just confirmed, I even tested with blocking UDP and still getting an answer but you have to tell it to use TCP with the host command ) From mac/linux you can do like: host -T google.com <http://google.com/> 192.168.88.1 nslookup probably can be used to test as well on a Micro$oft box Sincerely, Joshaven Potter Google Hangouts: [email protected] Cell & SMS: 1-517-607-9370 [email protected] > On Sep 6, 2016, at 1:20 PM, Matt <[email protected]> wrote: > > Does the Mikrotik DNS cache listen on both TCP and UDP port 53? In > past I always dropped both in input chain on the pppoe interface but I > am not sure it actually listens on the TCP port? > >> Assuming you have DNS set to Allow Remote Requests (which must be on for >> local customers to use the Mikrotik as their DNS server), make sure you have >> an Input chain rule to drop UDP and TCP destination port 53 on the WAN >> interface. Mikrotik’s QuickSet leaves the router open to DNS amplification >> attacks. >> >> Also check if you have NTP server enabled, that’s another amplification >> attack method. >>
