0 Shares

MikroTik DNS Cache and Web Proxy: Optimizing Internet Access

MikroTik RouterOS includes two built-in caching mechanisms that are often confused but serve very different purposes: the DNS cache and the web proxy cache. Used correctly, they reduce latency, lower upstream bandwidth consumption, and improve the browsing experience for LAN clients. Used incorrectly, they can waste router resources, create security exposure, or deliver little benefit because modern web traffic is overwhelmingly HTTPS.

This guide explains how both features work, when each one is worth enabling, how to configure them safely in RouterOS, and which tuning parameters matter most. Command examples target RouterOS v7, but the concepts apply broadly to RouterOS v6 as well.

1. Introduction

A MikroTik router can act as a DNS cache for every device on the LAN, and it can also act as an HTTP web proxy that caches web objects. Both features are available in RouterOS without additional licenses, and both are frequently recommended as “performance optimizations.”

However, the two mechanisms operate at different layers of the network stack and have different limitations. DNS caching accelerates the name resolution phase that precedes almost every connection. Web proxy caching accelerates content retrieval only for cacheable HTTP objects. In a modern network where most websites use HTTPS, DNS caching is usually the higher-impact optimization, while the web proxy is primarily useful for HTTP content filtering, HTTP bandwidth savings, and access control.

The goal of this article is to give network and systems engineers a practical, technically accurate reference for configuring both features safely and for deciding when each one is appropriate.

2. How MikroTik DNS Cache Works

2.1 What Is DNS Cache?

DNS is the system that maps human-readable hostnames to IP addresses. When a client asks the router to resolve a name, the router can forward the query to an upstream DNS server and then store the answer in its local DNS cache. Subsequent requests for the same name can be answered directly from the cache, avoiding an upstream round trip.

RouterOS enables this behavior with the allow-remote-requests=yes setting under /ip dns. When enabled, the router responds to DNS requests from LAN clients on UDP and TCP port 53 and caches the results according to the record TTL and the router’s configured limits.

2.2 Key DNS Cache Parameters

The most important DNS cache settings in RouterOS are summarized below.

Table 1. Key RouterOS DNS cache parameters
Parameter	Default	Description
`allow-remote-requests`	`no`	Allows the router to act as a DNS cache for remote clients. Without this, only the router itself uses its DNS configuration.
`cache-size`	`2048` KiB	Maximum DNS cache size in KiB. The documented range is 64 to 4294967295 KiB.
`cache-max-ttl`	`1w`	Upper bound on record TTL. Cached records expire unconditionally after this time, even if the upstream TTL is longer. Shorter upstream TTLs are respected.
`max-udp-packet-size`	`4096` bytes	Maximum UDP DNS packet size. Can be lowered to avoid fragmentation in some networks.
`max-concurrent-queries`	`100`	Maximum number of concurrent DNS queries allowed.
`servers`	empty	Upstream DNS servers used by the router. If empty, the router may use dynamic servers learned from DHCP.

2.3 Why DNS Cache Matters for HTTPS Traffic

DNS caching helps all IP traffic that uses hostnames, including HTTPS, because name resolution happens before the encrypted connection is established. Even when the web proxy cannot cache HTTPS content, the DNS cache still saves resolution time for every new connection.

This is the main reason DNS caching is the first optimization to enable on almost any MikroTik router that serves LAN clients.

3. How MikroTik Web Proxy Works

3.1 What Is Web Proxy?

The MikroTik web proxy under /ip proxy accepts HTTP requests from clients, fetches content from origin servers, and stores cacheable responses locally. If another client requests the same object, the proxy can serve it from cache instead of downloading it again[reference:7].

The web proxy also provides an access-list mechanism that can allow, deny, or redirect requests by client address, hostname, path, or HTTP method. This makes it useful as a basic HTTP content filter even when caching is not the primary goal[reference:8].

3.2 HTTP-Only Limitation and HTTPS

The most important limitation to understand is that the MikroTik web proxy caches plain HTTP only. HTTPS traffic is encrypted between the client and the origin server. In transparent mode the proxy cannot intercept HTTPS at all, and in explicit mode the proxy can relay HTTPS using the CONNECT method but cannot cache the content or inspect the request path[reference:9][reference:10].

As a result, the real-world cache hit rate of a MikroTik web proxy is often low on modern networks, because most web traffic is HTTPS.

3.3 Transparent Proxy vs Explicit Proxy

RouterOS supports two client-facing proxy modes.

Transparent proxy: A destination NAT rule redirects client HTTP connections (normally TCP port 80) to the proxy port. Clients do not need any browser or operating-system proxy settings. Transparent mode works for plain HTTP only[reference:11].
Explicit proxy: Clients are configured to send HTTP and HTTPS requests to the router’s proxy address and port. HTTPS is relayed via CONNECT but is not cached[reference:12].

The same proxy service can serve regular and transparent clients simultaneously[reference:13].

3.4 Key Web Proxy Parameters

Table 2. Key RouterOS web proxy parameters
Parameter	Typical value	Description
`enabled`	`no` by default	Enables or disables the proxy service[reference:14].
`port`	`8080`	TCP port on which the proxy listens. Multiple ports can be specified[reference:15].
`max-cache-size`	`unlimited` in many versions	Maximum total cache size. In current documentation the unit is KiB; 1048576 ≈ 1 GiB. Set an explicit limit to protect storage[reference:16].
`max-cache-object-size`	`4096` KiB	Objects larger than this are not cached. Raising it can improve byte-hit ratio but consumes more cache space[reference:17].
`cache-on-disk`	`no` (RAM cache)	When `yes`, the cache is stored on disk and requires formatted storage. When `no`, the cache resides in RAM[reference:18].
`max-client-connections`	depends on platform	Limits concurrent client connections to the proxy. Raise cautiously on low-end devices.

4. DNS Cache vs Web Proxy: Which One Improves Performance?

The two features optimize different parts of the request path. The table below summarizes the practical differences.

Table 3. DNS cache vs web proxy in MikroTik RouterOS
Aspect	DNS Cache	Web Proxy
What is cached	DNS records (name-to-IP mappings)	HTTP response objects (pages, images, files)
Traffic types accelerated	All IP traffic that uses hostnames, including HTTPS	Plain HTTP only for caching; HTTPS is relayed but not cached
Typical impact on modern networks	High, because DNS resolution precedes every connection	Low-to-moderate for caching, higher for HTTP filtering
Client configuration required	No, if DHCP hands out the router as DNS server	No in transparent mode; yes in explicit mode
Resource cost	Low to moderate (RAM for cache entries)	Moderate to high (RAM or disk, CPU for parsing HTTP)
Security risk if misconfigured	Open DNS resolver / amplification	Open proxy abuse
Best use case	Every LAN that uses the router as a DNS server	HTTP-heavy networks, content filtering, or explicit proxy requirements

In most modern networks, enable DNS caching first. Add the web proxy only if you have a specific need for HTTP caching, HTTP access control, or explicit proxy behavior.

5. Configuring MikroTik DNS Cache (Step-by-Step)

5.1 Enable DNS Cache for LAN Clients

The basic configuration enables remote requests, specifies reliable upstream DNS servers, and increases the cache size modestly.

/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes cache-size=4096 cache-max-ttl=1d

The values above use Cloudflare and Google public DNS as examples. Replace them with the DNS servers appropriate for your network and regulatory environment.

Make sure the DHCP server on the router hands out the router’s LAN IP address as the DNS server to clients. If clients receive a different DNS server via DHCP, they will bypass the MikroTik DNS cache.

5.2 Tune Cache Size and TTL

The default cache size of 2048 KiB is adequate for small home networks. For larger networks, 4096–8192 KiB is a common starting point. Monitor cache-used and router free RAM before increasing the value substantially.

The cache-max-ttl setting is a safety cap, not a replacement for upstream TTL values. The default of 1w is conservative. In environments where DNS records change frequently, consider 1d or even 1h. Shorter values increase upstream queries but reduce the chance of serving stale records.

For networks that experience DNS fragmentation issues, lowering max-udp-packet-size to 1232 is a known workaround. The default is 4096 bytes.

5.3 Secure the DNS Resolver

When allow-remote-requests=yes is enabled, the router listens on port 53. If the firewall allows DNS queries from untrusted networks, the router can become an open resolver and be abused for DNS amplification attacks.

Restrict DNS access to the LAN. The exact interface list name depends on your configuration, but the following pattern is common:

/ip firewall filter add chain=input protocol=udp dst-port=53 in-interface-list=!LAN action=drop comment="DNS: LAN only"
/ip firewall filter add chain=input protocol=tcp dst-port=53 in-interface-list=!LAN action=drop comment="DNS: LAN only"

Place these rules above any rule that broadly accepts input traffic.

5.4 Verify and Monitor DNS Cache

Check the effective DNS configuration:

/ip dns print

Inspect cached A records:

/ip dns cache print

Inspect all cached record types:

/ip dns cache all print

Flush the DNS cache after making DNS changes or when troubleshooting stale records:

/ip dns cache flush

The cache-used field in /ip dns print shows how much of the configured cache is currently in use. If it consistently sits at the limit, consider increasing cache-size.

6. Configuring MikroTik Web Proxy (Step-by-Step)

6.1 Enable the Proxy Service

Enable the proxy and set a port. The proxy is disabled by default[reference:20].

/ip proxy set enabled=yes port=8080

To set an explicit cache limit and keep the cache in RAM:

/ip proxy set max-cache-size=1048576 max-cache-object-size=4096 cache-on-disk=no

The value 1048576 in current documentation represents approximately 1 GiB because the unit is KiB. Confirm the unit in your RouterOS version before applying large values.

6.2 Secure Against Open Proxy Abuse

A proxy that is reachable from untrusted networks is an open proxy. Attackers can relay traffic through it and hide their origin. Restrict proxy access to the LAN:

/ip firewall filter add chain=input protocol=tcp dst-port=8080 in-interface-list=!LAN action=drop comment="web proxy: LAN only"

For IPv6, add the equivalent rule in /ipv6 firewall filter if IPv6 is in use.

You can also use the proxy access list to enforce client restrictions. The following example allows the LAN subnet and denies everything else:

/ip proxy access add src-address=192.168.88.0/24 action=allow
/ip proxy access add action=deny

Replace 192.168.88.0/24 with your actual LAN subnet. Rules are processed top-to-bottom, and the first match wins[reference:21].

6.3 Configure Transparent Proxy with NAT

Transparent mode requires a destination NAT rule that redirects HTTP traffic to the proxy port. Do not redirect HTTPS port 443; the proxy does not accept TLS connections in transparent mode, and redirected HTTPS connections will fail[reference:22].

/ip firewall nat add chain=dstnat protocol=tcp dst-port=80 in-interface-list=LAN action=redirect to-ports=8080 comment="transparent web proxy"

In this mode, clients do not need any browser proxy settings. The proxy connects to the host named in the HTTP Host header, not to the address the client originally connected to[reference:23].

6.4 Configure Explicit Proxy Clients

In explicit mode, configure client browsers or operating systems to use the router’s LAN IP address and the proxy port for both HTTP and HTTPS. The proxy relays HTTPS using CONNECT but cannot cache or inspect the content[reference:24].

To test the proxy from a Linux or macOS client with curl:

curl -x http://192.168.88.1:8080 -I http://example.com/

For HTTPS relay testing:

curl -x http://192.168.88.1:8080 -I https://example.com/

6.5 Cache Storage: RAM vs Disk

RAM cache is faster but limited by the router’s available memory. Disk cache allows a much larger cache but adds storage I/O latency and requires formatted, mounted storage.

Historical MikroTik documentation notes that disk cache also consumes RAM for metadata: plan at least 11.2 MB of RAM per 1 GB of cache plus 32 MB reserved for the system when sizing disk cache[reference:25]. On low-end routers, disk cache can cause more harm than benefit because of slow storage and limited RAM.

If you enable disk cache, set an explicit max-cache-size rather than leaving it unlimited. Leaving it unlimited on a small disk can fill storage and affect system stability.

6.6 Monitor and Flush Web Proxy Cache

Check proxy status, connection counts, requests, hits, and cache usage:

/ip proxy monitor once

The output includes fields such as requests, hits, cache-used, and total-ram-used. A very low hit count relative to requests is normal on HTTPS-heavy networks[reference:26].

View active proxy connections:

/ip proxy connections print

Flush the web proxy cache after changing access rules or troubleshooting stale content:

/ip proxy cache flush

For detailed request logging, add a logging rule for the web-proxy topic:

/system logging add topics=web-proxy,!debug

Without !debug, the log also includes request and response headers, which can be noisy[reference:27].

7. Optimization Best Practices

7.1 Size the DNS Cache Correctly

Start with the default 2048 KiB for small networks and increase to 4096–8192 KiB for larger LANs. Watch cache-used and free RAM. If the cache is constantly full and the router has spare memory, increase it. If the router is memory-constrained, leave it at the default or reduce it slightly.

7.2 Set Sensible Cache TTLs

Respect upstream TTLs and use cache-max-ttl only as a cap. The default 1w is safe for stable environments. For dynamic environments, 1d or 1h reduces stale-record risk at the cost of more upstream queries.

7.3 Prefer DNS Cache for Modern HTTPS-Heavy Networks

DNS caching benefits every connection that uses a hostname, including HTTPS. It is the highest-value caching feature on most MikroTik routers. Enable it before considering the web proxy.

7.4 Use Web Proxy Only Where HTTP Caching Helps

The web proxy is most useful when:

You need HTTP content filtering or access control.
You have a significant volume of cacheable plain-HTTP traffic.
You require explicit proxy behavior for compliance or client configuration reasons.
You want to relay requests through a parent proxy.

Do not expect large bandwidth savings from web proxy caching on networks dominated by HTTPS.

7.5 Avoid Disk Cache on Low-End Devices

Disk cache adds I/O latency and metadata memory overhead. On routers with limited RAM or slow storage, RAM-only cache with a modest max-cache-size is usually a better trade-off. If disk cache is required, use reliable storage and set an explicit cache limit.

7.6 Protect Router Resources

Both DNS cache and web proxy consume RAM and CPU. Monitor router health after enabling either feature. If CPU or memory utilization rises significantly, reduce cache sizes, disable disk cache, or disable the web proxy if it is not delivering measurable benefit.

8. Security Considerations

8.1 DNS Amplification and Open Resolver

An open DNS resolver can be abused in DNS amplification attacks. When allow-remote-requests=yes is enabled, restrict UDP and TCP port 53 to trusted LAN interfaces. Never expose the resolver to the public internet unless you have implemented rate limiting and other protections.

8.2 Open Proxy Abuse

An open web proxy allows anyone to relay traffic through your router, hiding their origin. Restrict proxy access with firewall rules and proxy access lists. The default firewall configuration often protects the proxy indirectly, but explicit rules are strongly recommended[reference:28].

8.3 Logging and Privacy

Web proxy logging can record client IP addresses, URLs, and request methods. Enable detailed logging only when troubleshooting, and protect log storage accordingly. DNS cache contents can also reveal browsing patterns; restrict administrative access to the router.

9. Troubleshooting Common Issues

9.1 DNS Cache Not Being Used

Verify allow-remote-requests=yes under /ip dns.
Confirm that DHCP hands out the router’s LAN IP as the DNS server.
Check firewall rules to ensure LAN clients can reach UDP/TCP port 53.
Inspect /ip dns cache print to see whether records are being cached.

9.2 HTTPS Sites Fail in Transparent Proxy Mode

Transparent mode works for plain HTTP only. Ensure the NAT redirect rule matches dst-port=80 and does not redirect port 443. Redirecting HTTPS to the proxy port causes connection failures because the proxy does not accept TLS connections in transparent mode[reference:29].

9.3 Low Web Proxy Cache Hit Rate

This is expected on HTTPS-heavy networks. The proxy cannot cache HTTPS content, and many HTTP responses are marked non-cacheable by origin servers. Check /ip proxy monitor once for hit counts, and consider whether the web proxy is providing enough value to justify its resource cost[reference:30].

9.4 High CPU or Memory Usage After Enabling Web Proxy

Reduce max-cache-size.
Disable disk cache if it is enabled.
Lower max-client-connections.
Disable detailed web-proxy logging.
If the router is low-powered, consider disabling the web proxy and relying on DNS caching instead.

10. Conclusion

MikroTik DNS cache and web proxy are complementary but unequal tools. The DNS cache is lightweight, benefits all hostname-based traffic including HTTPS, and should be enabled on essentially every MikroTik router that serves LAN clients. The web proxy provides HTTP caching and content filtering but is limited by its inability to cache HTTPS, making it a secondary optimization for most modern networks.

Configure DNS caching first, size it appropriately, and secure it against open-resolver abuse. Add the web proxy only when its HTTP-specific capabilities justify the additional CPU, memory, and management overhead. With the right sizing and security rules, both features can contribute to a faster and more efficient internet access experience.

11. Key Takeaways

DNS cache accelerates name resolution for all traffic, including HTTPS. It is the highest-impact caching feature on most MikroTik routers.
Web proxy caching works for plain HTTP only. HTTPS is relayed but not cached, so hit rates are often low on modern networks.
Enable DNS cache with allow-remote-requests=yes and hand out the router as the DNS server via DHCP.
Default DNS cache size is 2048 KiB; 4096–8192 KiB is reasonable for larger LANs if RAM allows.
Default cache-max-ttl is 1 week. Lower it to 1 day or 1 hour in dynamic environments.
Transparent web proxy requires a NAT redirect for TCP port 80 only. Do not redirect HTTPS[reference:33].
Secure both features: restrict DNS to the LAN and prevent open proxy abuse with firewall rules and access lists.
Monitor before and after enabling: use /ip dns print, /ip proxy monitor once, and router resource graphs.

12. References and Further Reading

MikroTik RouterOS documentation: DNS — https://help.mikrotik.com/docs/pages/viewpage.action?pageId=171507733
MikroTik RouterOS documentation: Web Proxy — https://manual.mikrotik.com/docs/7.25/network-management/proxy/web-proxy/
MikroTik documentation: Web Proxy (community mirror) — https://mikrotikdocs.fyi/ip/web-proxy/
MikroTik legacy documentation: Proxy — https://help.mikrotik.com/docs/pages/diffpagesbyversion.action?pageId=132350000&originalVersion=2&revisedVersion=5
MikroTik legacy documentation: Web Proxy reference — https://mikrotik.com/documentation/manual_2.7/RouterOS_2_7_ReferenceManual.pdf

Check our list of MikroTik guides