topic Re: Forward DNS requests in General Topics

Forward DNS requests

Retired Member — Thu, 06 Jun 2013 06:32:50 GMT

Hi,

We are looking for a way to forward All dns requests to internal DNS ip.

Either client changes its ip address to public dns addresses it should be forwarded to internal.

Can we do that ?

We don't want to write a deny rule for public Dns requests.

We don't want to enforce client's dns.

Re: Forward DNS requests

VinceM — Thu, 06 Jun 2013 07:29:24 GMT

Hi,

If you configure a dns proxy it should work.

The only limit is dns proxy can only be apply to suer traffic not palo management interface.

Re: Forward DNS requests

Retired Member — Thu, 06 Jun 2013 13:50:16 GMT

That did not work.When you use dns proxy can you override client Dns config ?

Re: Forward DNS requests

VinceM — Thu, 06 Jun 2013 13:55:21 GMT

Hi,

Not changing the client DNS but proxify it.

Client send request for xxx.mydomain.com to 8.8.8.8 dns server

Arrive on the palo, palo proxy the request and forward to 172.16.10.10

this is what you want ?

Re: Forward DNS requests

Retired Member — Thu, 06 Jun 2013 14:14:17 GMT

we tried that but didn't work

ex. you have Lan and Wan interface

in dns proxy how should we configure to do that ?

adding interface and type dns on left is enough ?

Re: Forward DNS requests

mr.linus — Thu, 06 Jun 2013 14:33:31 GMT

why not just add a destination NAT?

source: trust

destination: untrust

service: DNS

=> destination NAT to your DNS server

now all DNS requests to an external server are routed to your DNS server.

Just keep a look out for asymmetric routing.

Re: Forward DNS requests

VinceM — Thu, 06 Jun 2013 14:42:27 GMT

Hi,

Come back to the office, take a palo and test. You're right, for dns proxy working, dns client have to be configured on palo's interface ip.

In my mind it should act as transparent dns proxy .... but no.

take in consideration the LinusRaes solution, do your redirection through nat rule.

Re: Forward DNS requests

Retired Member — Thu, 06 Jun 2013 14:44:48 GMT

This is not working for any ip.you cannot dest. NAT any ip to 1 ip

Re: Forward DNS requests

ericgearhart — Thu, 06 Jun 2013 14:58:24 GMT

You know honestly it's not a "DNS Proxy" at all... I thought it would be transparent when I saw the name "DNS Proxy" too. They really ought to just name it flat out "Caching Only DNS Server," because that's essentially what it it (with some static entries permitted in order to do DNS doctoring)

Re: Forward DNS requests

mr.linus — Thu, 06 Jun 2013 14:59:22 GMT

This is not working for any ip.you cannot dest. NAT any ip to 1 ip

ahhh, that's right, I forgot. If i recall correctly Juniper can do this 😉

Re: Forward DNS requests

Retired Member — Thu, 06 Jun 2013 15:02:25 GMT

I tested but it did not work

there is ony 1 nat rule and 1 security rule in test lab

Re: Forward DNS requests

VinceM — Thu, 06 Jun 2013 19:06:27 GMT

It is necessary to face the facts, it should be not possible, otherwise you have to install a transparent proxy.

Re: Forward DNS requests

Retired Member — Thu, 06 Jun 2013 19:11:14 GMT

sometimes there are solutions that we can't remember

Thanks for answers all.

Re: Forward DNS requests

mikand — Fri, 07 Jun 2013 18:51:21 GMT

Doesnt PANOS 5.0 contain a dns-proxy where you can rewrite dns-queries passing through so they are forced to a dns-server of your choice?

Re: Forward DNS requests

craymond — Fri, 07 Jun 2013 19:23:26 GMT

According to the Docs:

For all DNS queries that are directed to an interface IP address, the firewall supports the selective directing of queries to different DNS servers based on full or partial domain names. TCP or UDP DNS queries are sent through the configured interface. UDP queries fail over to TCP when a DNS query answer is too long for a single UDP packet.

If the domain name is not found in the DNS proxy cache, the domain name is searched for a match based on configuration of the entries in the specific DNS proxy object (on the interface on which the DNS query arrived) and forwarded to a name server based on the match results. If no match is found, the default name servers are used. Static entries and caching are also supported.

It would be interesting to try.

Re: Forward DNS requests

NGS_SOC — Sat, 08 Jun 2013 08:16:15 GMT

Hi, except from DNS-proxy another way to accomplish this is using U-turn NAT configuration

Source Zone: Trust-Zone

Dest Zone: Untrust-Zone

service: dns (53tcp +53udp)

Source : Your internal network

Dest: External Dns server IP (ie 8.8.8.8 google)

Source translate: dynamic-ip-port (PAT) of your internal firewall interface

Dest translate: Your internal DNS server IP

Also you need a permit security policy from Trust-Zone to Trust-Zone

The drawback that you need a NAT entry for every external dns server, but if you verify which ones is mostly used I think that 10 rules could match 90% of your dns external requests.

Re: Forward DNS requests

Retired Member — Sat, 08 Jun 2013 08:36:18 GMT

That solution is talked before.There are many Dns public and 1 rule for every ip is not good.

Thanks.