topic Re: DNS Proxy in General Topics

DNS Proxy

zaidshaikh — Tue, 07 Apr 2020 08:49:37 GMT

guys,

i wanna achieve dns proxy wherein my requirement is as follows:

1. i wanna use my internet browsing PCs to use palo alto defined DNS which will use our ADSL 100mbps connection for browsing.

2. secondly, my other critical PCs will use DNS from existing AD and use Lease Line internet for server access and mission critical tasks.

i feel i can achieve this via dns proxy feature in PAN , but little confused how to go abt it.

appreciate help

Re: DNS Proxy

SutareMayur — Tue, 07 Apr 2020 15:46:06 GMT

@zaidshaikhPlease correct me if i am wrong,

You have two internet links on your firewall. One is ADSL and other is Lease line connection. Your Critical PCs internet goes from Lease line connection. For the internet traffic that is going via Lease line connection, you need Palo Alto to be act as DNS proxy.

Just one question, where is gateway configured for the subnet where all critical PCs resides?

Mayur

Re: DNS Proxy

zaidshaikh — Wed, 08 Apr 2020 03:30:38 GMT

Mayur

We have internet PCs wherein the gateway is the palo alto fw, what i need to achieve is when the PC is browsing for normal internet access we need PAN to provide Public DNS to it.

Whereas when the same PC wants to access our internal servers or internal infra, we need PAN to redirect those dns request to our internal DNS server.

Re: DNS Proxy

SutareMayur — Wed, 08 Apr 2020 08:24:13 GMT

@zaidshaikh,

Ok then you can configure DNS proxy on the interface of Palo Alto Firewall which is the gateway of PCs. Under DNS proxy configuration, you can add Primary and Secondary DNS servers that you want to configure for PCs network. And for your other requirement i.e. to redirect internal URLs to internal DNS servers, you can achieve it using below two ways,

1. Add DNS proxy rule where you'll define internal domains and internal DNS servers for those domains. So DNS query for those internal DNS will be send to configured internal DNS servers. Here PA forward selective domains to the DNS servers which are different from the configured primary and secondary servers.

2. You can even add Static entries for internal URLs under DNS Proxy Configuration. You can statically define domain/FQDN and its associated server address. So if anyone is trying to access internal URL, the request will be directly forwarded to configured address.

Hope it helps you!

Mayur

Re: DNS Proxy

zaidshaikh — Wed, 08 Apr 2020 09:50:29 GMT

thanks mate for the reply,

what i did before is I enable ADSL service by policy based forwarding---- it worked fine.

then DNS-Proxy configured, with primary as 8.8.8.8 and DNS Rule match for internal severs .100 and .101 for internal dns requests.

Now, as soon as i change the PC dns ip to that of the interface ip for which the DNS-Proxy is configured, nslookup for google.com or any dns is not resolving. This is one part.

Later,

I did this same thing by using our existing Lease Line NAT policy wherein i just added this new interface-zone into the NAT policy and committed. It worked fine on the PC resolving all dns outside and our company domain name to its IP.

So, is there i am missing with ADSL config ? i think so

Secondly, is there anything i need to comfigure on the Comain controller where the our dns-server is configured to resolve hostnames of PCs etc.

Re: DNS Proxy

SutareMayur — Wed, 08 Apr 2020 11:17:59 GMT

@zaidshaikhIn first part, make sure you have required policies to allow DNS traffic towards public DNS from the interface. What do you see in the traffic logs? I suspecting issue with policies only as you said it works fine from Lease line connection.

Also check dnsproxy related logs by using command - tail follow yes mp-log dnsproxyd.log

Check what is the o/p of this command.

Nothing is required to be configured on DC.

Mayur

Re: DNS Proxy

zaidshaikh — Thu, 09 Apr 2020 03:47:14 GMT

Thanks Mayur i will do it today. apprise you

Re: DNS Proxy

zaidshaikh — Wed, 15 Apr 2020 05:00:49 GMT

@Mayur

Actually i got engaged to other activities, was off-the hook with this case..

I didn;t made the ADSL policy yet, instead we tried making web proxy server by adding IPs into exception lists on the the browser settings, to make it easy.

In this case also, I am able to put IPs the the exception list , but not the Ports (eg: 172.16.11.12:8888), is there any way to add ports in the list?

we found this proxry server way is more easy and relatable to us.

Re: DNS Proxy

SutareMayur — Wed, 15 Apr 2020 09:29:49 GMT

@zaidshaikh,

I am confused now, what exactly are you trying to do? As per my understandings, you want to use Palo Alto as DNS proxy server where PA FW will reside between client and server for DNS queries. Hope this is your requirement.

Mayur

Re: DNS Proxy

zaidshaikh — Wed, 15 Apr 2020 11:07:28 GMT

yes , what i am thinking is if a configure the DNS proxy on PAN, the PC gateway will be that of PAN interface, and through this interface the DNS request will flow accordingly. However, what about the reverse traffice, i mean if the domain controller(DC) pushes some changes to these PCs, then how DC will communicate, since this DC is directly communicating with the PCs currently.

I dont want to ask the system team,for any changes/additional configs request. Thats y tried web-proxy.

regret confusing you much

Re: DNS Proxy

SutareMayur — Wed, 15 Apr 2020 12:00:47 GMT

@zaidshaikh,

Whatever configuration that we are discussing is related to DNS traffic only. As per my understanding, this shouldn't affect your group policy updates from DC etc. For that your system should be part of domain that's it and there should be reachability between PCs and DC.

Mayur

Re: DNS Proxy

zaidshaikh — Thu, 16 Apr 2020 03:15:13 GMT

I will check and let u know

Thanks mayur for ur insights.

Re: DNS Proxy

BK0007 — Thu, 16 Apr 2020 05:02:44 GMT

@zaidshaikh ,

I think, you are mixing two things, group policy push and dns functionalities.

Re: DNS Proxy

zaidshaikh — Thu, 16 Apr 2020 05:20:14 GMT

@BK0007

Yes. just now i tried the putting my PC with this new interface IP, am able to resolve dns names also my PC is effecting changes via domain and dns.

Thanks BK and Mayur for making me understand.

Now the problem is the same with DNS proxy(ie PAN) also, am not able to resolve any internal URLs (like 172.16.60.X:8888) to resolve i want to know how to add/or put ports insode the DNS proxy rules inside PAN.

Thanks Guy:)

Re: DNS Proxy

SutareMayur — Thu, 16 Apr 2020 06:39:33 GMT

@zaidshaikh,

Have you added DNS proxy rules?

Under DNS proxy rules, you can add internal URLs and under domain name section (without port) and internal DNS servers under Primary and Secondary tab. With this, PA firewall will forward mentioned domains to mentioned dns servers. Just make sure, there is reachability internal DNS servers IPs.

The other way is to add static entries. Under Static entries tab, enter FQDN and it's associated address.

Hope it helps!

Mayur

Re: DNS Proxy

zaidshaikh — Thu, 16 Apr 2020 06:46:13 GMT

Yes i added both dns proxy rules and static entries.

But inside the static entry page also the address need to mention for a fqdn also is only taking ( 172.X.X.X) NOT (172.X.X.X:8888)

i wanna achieve the latter part of this.

Re: DNS Proxy

SutareMayur — Thu, 16 Apr 2020 07:42:14 GMT

@zaidshaikh,

Why do you want to add port? It will only accept IP address not port.

Mayur

Re: DNS Proxy

zaidshaikh — Thu, 16 Apr 2020 07:50:10 GMT

becoz there are servers internally which is running on different services.

otherwise all is working fine. but i cannot move forward if other teams are not able to access these servers for their activity.

Re: DNS Proxy

SutareMayur — Thu, 16 Apr 2020 08:17:10 GMT

@zaidshaikh,

You can't add port in this settings, firewall will not allow to configure same.

Also your requirement should be fulfilled without adding port. If you are using DNS proxy rule, you just add DNS server IP against the internal URL. And under static entries, you just need to mention URL against its associated IP. For this, it is not required to configure service port, it should work properly.

Mayur

Re: DNS Proxy

zaidshaikh — Thu, 16 Apr 2020 08:30:07 GMT

Yes you are right.

Becoz we understand is that the dns proxy is doing its job by resolving the URls to IPs configured in the DNS-Proxy.

About Port issue i believe it out of this topic..