Traffic Deny due to DNS?

cancel
Showing results for 
Search instead for 
Did you mean: 

Traffic Deny due to DNS?

L0 Member

Hello,

 

I was given a chunk of IP addresses and domains/urls to update into an existing blacklist on the firewall.  I go to objects and create ip-netmask for ip addresses and FQDN objects for domains/urls. Some of the domains i received come in the form of url like "xxxxxx.xxx.com/*" and "https://xxxxxxxx.com/xxxx/xxxx.zip   " I decided to create an FQDN object for the domain of xxxxxx.xxx.com instead of xxxxxx.xxx.com/* because FQDN does not allow '/'. I did not create custom URL category for the long urls. When i committed and pushed the firewall changes to the device, some of the users who are accessing a work url that is not relevant to the ones i have blacklisted began to experience connectivity issue. 

The traffic logs flowing towards 1.1.1.1 and 8.8.8.8 seems to be deny and drop. 

dnserror.png

 

After this failure, I created a custom URL category for those urls which i created FQDN object for earlier and attached in the service url category of the firewall blacklist rule.  The FQDN object i created for the url to block the domain is still present. The traffic towards the 1.1.1.1 and 8.8.8.8 seems to be resolved and the users are able to access their work-related url. 

 

I then removed the FQDN objects that i created to for the url, and the traffic is working. I

I removed both the FQDN object for the url and the custom url category, the DNS deny policy shows up again.

When i added the custom url category back onto the firewall rule, the DNS is resolved. 

 

May i know if anyone here has experienced similar issues and know what has happened that caused this. 

Is is because the DNS server could not resolve the FQDN object and results in this deny policy towards the DNS?

 

 

Thanks

1 REPLY 1

Cyber Elite
Cyber Elite

Hello,

For some reason I see this from time to time as well. Something in windows is causing it or some program wants to use one of those servers for DNS. What I did was to only allow internal clients to get DNS from our internal servers. Then blocked the clients and servers, except for the dns servers, from going out to get DNS. This stop beaconing malware. I made this presentation for a conference if you care to watch it. 

https://youtu.be/ROIAYSEbTuo

Basically, force the systems to use your DNS, use a secure DNS provider, and block all other DNS requests, including dns over https and quic.

 

Regards,

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!