Forward DNS requests

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L6 Presenter

I tested but it did not work

there is ony 1 nat rule and 1 security rule in test lab

Highlighted
L5 Sessionator

It is necessary to face the facts, it should be not possible, otherwise you have to install a transparent proxy.

V.

View solution in original post

Highlighted
L6 Presenter

sometimes there are solutions that we can't remember :smileyhappy:

Thanks for answers all.

Highlighted
L6 Presenter

Doesnt PANOS 5.0 contain a dns-proxy where you can rewrite dns-queries passing through so they are forced to a dns-server of your choice?

Highlighted
L4 Transporter

According to the Docs:

For all DNS queries that are directed to an interface IP address, the firewall supports the selective directing of queries to different DNS servers based on full or partial domain names. TCP or UDP DNS queries are sent through the configured interface. UDP queries fail over to TCP when a DNS query answer is too long for a single UDP packet.

If the domain name is not found in the DNS proxy cache, the domain name is searched for a match based on configuration of the entries in the specific DNS proxy object (on the interface on which the DNS query arrived) and forwarded to a name server based on the match results. If no match is found, the default name servers are used. Static entries and caching are also supported.

It would be interesting to try.

The inherent vice of capitalism is the unequal sharing of blessings; the inherent virtue of socialism is the equal sharing of miseries.
Highlighted
L3 Networker

Hi, except from DNS-proxy another way to accomplish this is using U-turn NAT configuration

Source Zone: Trust-Zone

Dest Zone: Untrust-Zone

service: dns (53tcp +53udp)

Source : Your internal network

Dest: External Dns server IP (ie 8.8.8.8 google)

Source translate: dynamic-ip-port (PAT) of your internal firewall interface

Dest translate: Your internal DNS server IP

Also you need a permit security policy from Trust-Zone to Trust-Zone

The drawback that you need a NAT entry for every external dns server, but if you verify which ones is mostly used I think that 10 rules could match 90% of your dns external requests.

Highlighted
L6 Presenter

That solution is talked before.There are many Dns public and 1 rule for every ip is not good.

Thanks.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!