How Palo Alto enabled with DNS Sinkhole will see original Client IP Address; when internal DNS server working in Recurisive mode?

[ankush3597]

Hi All,

I need help in solution to know how actually Palo Alto enabled with DNS Sinkhole will see original client IP Address making DNS request to a domain in DNS sinkhole list.

More Information is:

My client computer with IP address (10.10.10.10) configured with Internal DNS server with IP Address (10.10.10.20). Internal DNS server working in the recursive mode so if it does not have DNS answer; it will send DNS queries to TLDs to get an answer.

For both my client computer and internal DNS server, Gateway is Palo Alto Next-Generation Firewall with Gateway address 10.10.10.1

I have enabled DNS Sinkhole to domain query lets say example.com to 10.10.10.254.

Now in this setup how my Palo Alto firewall will identify who was original client requested for example.com because we know DNS server will send DNS request with its own source IP address to the Internet and not with original Client IP Address.

[reaper · Accepted solution]

Sinkhole will 'poison' the DNS reply.

so usually the client sends a dns request to the internal dns, the internal dns then requests the information from the TLD, the tld replies with an IP address  for the A/AAAA record, and the Palo Alto will then replace the IP with the sinkhole IP

the internal DNS relays the poisoned answer to the client and the client then tries to connect to the sinkhole IP, this is how you know the client was the original requestor