routeros-scripts VS mikrotik-scripts

Check the eworm scripts: https://github.com/eworm-de/routeros-scripts

Among many other useful scripts there is one for automatic ipv4 DNS-names: https://github.com/eworm-de/routeros-scripts

If on top of this, like me, you still want to be able to reference the INTERNAL resolver from the container (for example because you create static DNS entries for DHCP leases, add src-address=!172.17.0.2 to command 8 and configure an upstream option in your Control D config accordingly.

/interface bridge add admin-mac=48:8F:5A:2D:66:01 auto-mac=no name=bridge-rb4011 /interface ethernet set [ find default-name=ether1 ] name=ether1-wan set [ find default-name=ether10 ] name=ether10-wifi set [ find default-name=sfp-sfpplus1 ] disabled=yes name=sfpplus1 /interface wireguard add listen-port=51820 mtu=1420 name=wireguard1 private-key="xxx" /interface pppoe-client add add-default-route=yes disabled=no interface=bridge-rb4011 max-mtu=1480 name=pppoe-ais password=xxx user=xxx /interface list add name=WAN add name=LAN add name=INET /ip pool add name=main-pool ranges=10.66.11.2-10.66.11.222 /ip dhcp-server add address-pool=main-pool interface=bridge-rb4011 lease-script="[removed script, see https://github.com/arktronic/mikrotik-scripts/blob/main/dhcp-dns.rsc]" name=dhcp-main /interface bridge port add bridge=bridge-rb4011 ingress-filtering=no interface=ether2 add bridge=bridge-rb4011 ingress-filtering=no interface=ether3 add bridge=bridge-rb4011 ingress-filtering=no interface=ether4 add bridge=bridge-rb4011 ingress-filtering=no interface=ether5 add bridge=bridge-rb4011 ingress-filtering=no interface=ether6 multicast-router=disabled add bridge=bridge-rb4011 ingress-filtering=no interface=ether7 multicast-router=disabled add bridge=bridge-rb4011 ingress-filtering=no interface=ether8 add bridge=bridge-rb4011 ingress-filtering=no interface=ether9 add bridge=bridge-rb4011 ingress-filtering=no interface=ether10-wifi add bridge=bridge-rb4011 ingress-filtering=no interface=sfpplus1 add bridge=bridge-rb4011 ingress-filtering=no interface=ether1-wan multicast-router=disabled /interface list member add interface=pppoe-ais list=WAN add interface=ether1-wan list=WAN add interface=bridge-rb4011 list=LAN add interface=bridge-rb4011 list=INET add interface=wireguard1 list=INET add interface=wireguard1 list=LAN /interface wireguard peers add allowed-address=10.66.2.2/32 endpoint-address=10.66.2.1 interface=wireguard1 public-key="xxx" add allowed-address=10.66.2.3/32 endpoint-address=10.66.2.1 interface=wireguard1 public-key="xxx" add allowed-address=10.66.2.4/32 endpoint-address=10.66.2.1 interface=wireguard1 public-key="xxx" /ip address add address=10.66.2.1/24 interface=wireguard1 network=10.66.2.0 add address=10.66.11.1/24 interface=bridge-rb4011 network=10.66.11.0 /ip dhcp-server network add address=10.66.11.0/24 comment=main-dhcp-network dns-server=10.66.11.1 gateway=10.66.11.1 /ip dns set allow-remote-requests=yes use-doh-server=https://dns.nextdns.io/xxx verify-doh-cert=yes /ip dns static add address=45.90.1.0 name=dns.nextdns.io add address=45.90.2.0 name=dns.nextdns.io add address=10.66.11.1 name=router.lan [removed dns entries for brevity] /ip firewall filter add action=drop chain=forward comment="Drop invalid connections" connection-state=invalid add action=accept chain=forward comment="Allow established/related/untracked connections" connection-state=established,related,untracked add action=accept chain=forward comment="Allow internet access" in-interface-list=INET out-interface-list=WAN add action=accept chain=forward comment="Allow LAN access from Wireguard" in-interface=wireguard1 out-interface-list=LAN add action=accept chain=forward comment="Allow service A from internet" dst-port=443 in-interface-list=WAN protocol=tcp add action=accept chain=forward comment="Allow service B from internet" dst-port=8080 in-interface-list=WAN protocol=tcp add action=drop chain=forward comment="Drop everything else" log-prefix=drop add action=drop chain=input comment="Drop invalid connections" connection-state=invalid add action=accept chain=input comment="Allow established/related/untracked connections" connection-state=established,related,untracked add action=accept chain=input comment="Allow LAN to access the router" in-interface-list=LAN add action=accept chain=input comment="Allow WireGuard from internet" dst-port=51820 log=yes log-prefix=wg protocol=udp add action=accept chain=input comment="Allow ICMP for everyone" protocol=icmp add action=drop chain=input comment="Drop everything else" log-prefix=dropped /ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN add action=dst-nat chain=dstnat comment="Public access to service A" dst-port=443 in-interface-list=WAN protocol=tcp to-addresses=10.66.11.2 to-ports=443 add action=dst-nat chain=dstnat comment="Public access to service B" dst-port=8080 in-interface-list=WAN protocol=tcp to-addresses=10.66.11.2 to-ports=8080

I've been using my own script on v6 and v7 (works on 7.1.1, haven't tried 7.4 yet).