DNS Proxy Configuration with VPN

Showing results for 
Show  only  | Search instead for 
Did you mean: 

DNS Proxy Configuration with VPN

L0 Member



I'm trying to route to some internal domain controllers for domain local DNS, and public DNS servers for everything else. This seems reasonably straight-forward except that when I specify the internal network IPs of the Domain DNS servers, they timeout all requests for domain DNS when looking up via the Palo DNS proxy. All other DNS resolves via the Palo DNS proxy OK.


If I create a public IP for our domain DNS servers and point the DNS Proxy domain lookups to the public IP of those DNS servers, the Domain DNS resolves as does all other DNS..


From the console, the host is able to ping the internal IP of the DNS servers and the DNS servers do not have a firewall, so will talk to anyone.


The network segment in question (containing the DNS servers) is behind a VPN that is being managed by the Palo Alto as well.


I've also created a security/zone policy that says that any zones except the external fibre interface are allowed outbound access to the VPN zone for any service, however it still times out.


I'm unsure how to even replicate this timeout from the Palo Alto console as I can't determine which interface the DNS Proxy makes its requests from


This guide was followed: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHfCAK


Cyber Elite
Cyber Elite

hen you ping the dns server from the firewall, are you sourcing the ping from the interface the dnsproxy is attached to or without source (mgmt interface)


is it possible a nat rule is between the dnsproxy interface and the vpn tunnel, or a security policy above your allow all that's still interfering?

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!