Skip to main content
TomWhi
TomWhi
New Member
August 11, 2018
Solved

DNS Relay / Proxy

  • August 11, 2018
  • 1 reply
  • 19878 views

Hi,

 

I have been asked to setup a DNS relay/proxy on our FortiGate 1200D, this sits on the perimeter of the network and has access to the internet.  Currently we have internal DNS servers which go through the FortiGate to our ISP, however it'd be nicer / cleaner that the FortiGate does the requests and all of our internal servers point to the FortiGate to do lookups against the ISP and return them to our internal domain controllers / DNS servers. 

 

I can see how to setup a DNS Server - but this doesn't seem to suite my need. Unless I am using the wrong words in Google, other search engines and the FN Forum - I'm really struggling to find good documentation how to make my FG into a relay. 

 

Any help, advice or guides would be amazing.  Thank you. 

Best answer by ede_pfau

Hi,

 

could you please clarify when/whether you want to use the internal DNS additionally?

Usually, you keep the local names on a local Windows server. The DNS DB feature on a FGT is not full-fledged; for instance, it won't register hostnames on DHCP lease request (but the Win server will).

In this case, the name resolution would be:

- internal hosts ask the FGT

- the FGT's DNS is the internal server

- the server's DNS is the provider's DNS

 

...which is a pity as then an internal server would have to contact an external source, plus you will have to supply the IPS's DNS to the server setup.

Much more preferred would be:

- internal hosts ask the server (so they'll profit from auto-registration)

- the server's DNS is the FGT

- the FGT's DNS is the provider's DNS (automatically)

 

This way, the FGT will proxy external names only (whose resolution is 'costly'), and the only host asking the ISP will be the FGT. The ISP's DNS address will be automatically published to the FGT if it uses PPPoE or DHCP towards the ISP.

 

Additionally, you should DENY all DNS requests from your hosts into the WAN, to prevent fake DNS responses/phishing. The guy with the mis-configured PC or smartphone will call, believe me.

 

In short, the FGT will ALWAYS proxy DNS requests, without any further configuration. And some configs are 'safer' than others.

1 reply

AQArquetiponet
AQArquetiponet
New Member
August 13, 2018

Hi Tom!!

 

Which version of FortiOS are you using?

 

If i understand good.. let ask if you are using DNS Database feature?

TomWhi
TomWhiAuthor
New Member
August 13, 2018

Hi,

 

I'm using 5.4.8.  We are not currently using the DNS Database feature. 

 

I have had a quick look and it seems that feature is what we'll need. I assume that I create a listener which is to the internal zones/interfaces that will listen to requests and then I can allow it to lookup locally, do a non-recursive or do a full recursive scan?  It looks like I'll set up full recursive which will look locally (I'll not have a local zone) so it'll use the DNS servers of my FortiGate to look externally...  Does that sound about right?

ede_pfau
SuperUser
ede_pfauAnswer
SuperUser
August 13, 2018

Hi,

 

could you please clarify when/whether you want to use the internal DNS additionally?

Usually, you keep the local names on a local Windows server. The DNS DB feature on a FGT is not full-fledged; for instance, it won't register hostnames on DHCP lease request (but the Win server will).

In this case, the name resolution would be:

- internal hosts ask the FGT

- the FGT's DNS is the internal server

- the server's DNS is the provider's DNS

 

...which is a pity as then an internal server would have to contact an external source, plus you will have to supply the IPS's DNS to the server setup.

Much more preferred would be:

- internal hosts ask the server (so they'll profit from auto-registration)

- the server's DNS is the FGT

- the FGT's DNS is the provider's DNS (automatically)

 

This way, the FGT will proxy external names only (whose resolution is 'costly'), and the only host asking the ISP will be the FGT. The ISP's DNS address will be automatically published to the FGT if it uses PPPoE or DHCP towards the ISP.

 

Additionally, you should DENY all DNS requests from your hosts into the WAN, to prevent fake DNS responses/phishing. The guy with the mis-configured PC or smartphone will call, believe me.

 

In short, the FGT will ALWAYS proxy DNS requests, without any further configuration. And some configs are 'safer' than others.

Terms & ConditionsAccessibility statement