How to redirect all internally generated DNS to a pool of public DNS servers

Forgot to mention the firewall is running 7.4.11. Here is what I’ve done so far, and within FortiManager I imported the new “vip-Public-DNS” created in the Firewall Objects>Virtual Servers into Policy Packages>Specific Policy>Central DNAT. The following config is what results in the FortiGate. What I’ve found out is that 0.0.0.0 doesn’t match all IP addresses. This gets no hits until I change it to something specific, such as 8.8.8.8, but then the “set src-filter” doesn’t restrict it to just the IP that’s configured. Absolutely every host in our network gets the DNS redirected, which I don’t want to do yet. Is there some reason 0.0.0.0 doesn’t match all (I can’t specify a mask, such as 0.0.0.0/0), and is there a way to actually restrict this to only the test system? 

config firewall ldb-monitor
    edit "DNS Health Check"
        set type dns
        set port 53
    next
end

config firewall vip
    edit "vip-Public-DNS"
        set uuid 8744af6c-5525-51f1-4e0c-a1f6644d4dd3
        set type server-load-balance
        set server-type udp
        set src-filter "172.16.20.20/32"
        set extip 0.0.0.0
        set extintf "Ethernet1/1"
        set monitor "DNS Health Check"
        set color 7
        set extport 53
        config realservers
            edit 1
                set ip 208.67.222.222
                set port 53
            next
            edit 2
                set ip 208.67.220.220
                set port 53
            next
            edit 3
                set ip 1.0.0.2
                set port 53
            next
            edit 4
                set ip 1.1.1.2
                set port 53
            next
        end
    next

Instead of setting up VIP. Your requirement is to sent DNS traffic to specific DNS sever.

This seems to be outbound traffic correct?

So you can setup DNS database on the FGT and setup FGT lan interface as the dns server.

All your request comes to the FortiGate and You can enable recursive DNS on the FGT and whatever DNS you have set to System DNS of FortiGate it will use that one

Thanks for the reply. We currently have outbound DNS queries to hundreds of public DNS servers, and we want to intercept these and send to 4 public DNS servers. I do not want to send traffic to a single DNS server or even to a pair of DNS servers controlled by the same company. Plus, we want some malware protection. We were using OpenDNS years ago when there was a major outage, so we need to use some type of round robin along with something to detect if the 4 DNS servers were using are alive or not.

Hello ​@221bbaker,

If you still want load balancing + health checking across multiple external DNS providers, a dedicated internal DNS forwarder/load balancer (Infoblox, BIND, Unbound, AdGuard, etc.) is usually cleaner than trying to do it with firewall VIP DNAT rules.

Or you can use DNS translation/filtering instead of central DNAT VIPs.

https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/83588/dns-translation

Regards,

Sheikh

We do have dedicated internal DNS servers in place. However, we have hundreds of internal hosts that are not pointed to them, other hosts controlled by vendors that are segmented from our network that we don’t want to use internal DNS, and yet other hosts in DMZs that are using public DNS servers that we need to change to the preferred. We will eventually get all of these changed, but I’m trying to find some way to apply changes at the firewall until we find the owners of the hosts and can make the change. 

I don’t think DNS translation will work. I don’t want to rewrite DNS payloads, but I do want to block access to malicious websites.