Intercept DNS requests

[dept_tec_bcn]

Hi all,

I've read in an article that it's possible to intercept DNS requests with DNS proxy without setting PA IP address as the computer DNS Server.

Following this article, I've enabled DNS proxy in a PA interface (inside), redirecting DNS request to a public DNS server; I've set up a DNS proxy rule to try to intercept the requests (for example, *.google.*) and created a DNS static entry like this: www.google.es --> 1.1.1.1

But if I set up a public DNS server in my computer (8.8.8.8 or any other) the DNS request are not intercepted, only if a set up the PA interface IP as my DNS the DNS requests are resolved as I want.

Is there anything wrong in my configuration? Or DNS proxy interception isn't really working?

[mikand]

Is it possible to perhaps setup a DNAT rule so outgoing appid=dns (standard-ports) will be destination natted into the PAN interface facing the client sending the DNS request?

[dept_tec_bcn]

No, that's not possible because of the scenario. In this scenario, there are some networks that are sharing the network hardware but are isolated in a VLAN. We don't know which DNS configuration they have, but we want that if they need to access to certain web pages, the DNS resolution points directly to our DMZ instead the public IP address.

I know which PA interface they're using, the network adresses for this VLAN and the domains I need to proxy, but I don't know the DNS configuration (could be any public server); so I need to intercept their DNS requests to mydomain.com and resolve them with my internal DNS servers.

Is this possible?

Thanks!

[reaper]

Hi

the DNS proxy doesn't intercept DNS queries but functions as a proxy: clients will need to be configured to use the PA's interface as a proxy server so they forward their DNS queries to the PA. The PA can then be configured to resolve certain URL's to a specific IP or forward these to an internal DNS server and forward all the other requests on to an internet DNS (or to an internal one).

If you want to be able to intercept DNS queries to unknown DNS servers you may want to try setting up a NAT rule that forwards all udp 53 traffic to an internal destination (or the DNS proxy IP) if they are sourced from the specific vlan.

regards

Tom