Technical Tip: Using a loopback interface as a local DNS server for SSL VPN

This configuration can be used when SSL VPN clients must use the DNS provided by the FortiGate.

The DNS server service on the interface only works on the 1st ingress physical interface.

To use FortiGate as the DNS server for SSL VPN clients, configure a loopback interface and use the loopback IP address as the DNS server for SSL VPN.

Configure the loopback interface.

config system interface
    edit ‘loopback1’
        set vdom ‘root’
        set ip 10.254.1.1 255.255.255.255
        set type loopback
    next
end

Configure the loopback interface as a DNS server.

config system dns-server
    edit ‘loopback1’
        set mode forward-only
    next
end

Configure the SSL VPN settings to assign the loopback IP address as the DNS server.

config vpn ssl settings
    set dns-server1 10.254.1.1
end

Create a firewall policy with the SSL VPN interface as the incoming interface and the loopback interface as the outgoing interface.

config firewall policy
    edit 0
        set srcintf ‘ssl.root’
        set dstintf ‘loopback1’
        set action accept
        set srcaddr ‘all’
        set dstaddr ‘all’
        set schedule ‘always’
        set service ‘DNS’
        set users ‘username’
    next
end

To confirm that the DNS traffic is being processed by the newly created policy between ssl.root and loopback1, use the command below:

diagnose firewall iprope show 00100004 <policy-id>

Sample output:

diagnose firewall iprope show 00100004 1
idx:1
pkts:20 (0 0 0 0 0 0 0 0)
bytes:568(0 0 0 0 0 0 0 0)
asic_pkts:9 (0 0 0 0 0 0 0 0)
asic_bytes:150 (0 0 0 0 0 0 0 0)
nturbo_pkts:0 (0 0 0 0 0 0 0 0)
ntubro_bytes:0 (0 0 0 0 0 0 0 0)
flag:0x0
hit count:10 (0 0 0 0 0 0 0 0)
first hit:2026-03-16 09:01:52 last hit:2026-03-16 09:01:52

After the SSL VPN client connects, verify that the assigned DNS server is the loopback IP address and confirm that DNS traffic through the loopback interface works as expected.