Restricting DNS

Question

New to Fortinet, but familiar with using other Firewalls.

I bought a Fortigate 60E with UTM license for home use, and I want to force my kids devices to use OpenDNS Family Shield DNS Servers, while allowing other devices to use regular DNS Servers.

I was able to do this with DD-WRT by using these commands:

iptables -t nat -I PREROUTING -i br0 -m mac --mac-source ##:##:##:##:##:## -p udp --dport 53 -j DNAT --to 208.67.222.123
iptables -t nat -I PREROUTING -i br0 -m mac --mac-source ##:##:##:##:##:## -p tcp --dport 53 -j DNAT --to 208.67.222.123

Even if the device changed DNS Servers manually, they were forced to use Family Shield.

How can I accomplish this with Fortinet?

Dave_Hall · Answer

This is doable. If the kid devices do not have statically assigned IPs, you can enabled Device Detection on the internal interface - after that go into User & Devices->Device Inventory> and locate your kid device and create/added it to a custom group (aka Kids-devices). When creating the firewall policy, choose the internal interface and set source to all and click on the device tab and select your kid devices group. Set the service to DNS and dest address to both Open DNS server IPs. Move this policy up in the firewall chain so it is triggered. Follow this up with creating a similar firewall policy using the same kid devices group as source and set the service to DNS and action to block - move this firewall policy below the first one.

Edit: this solution is likely not idea if looking for a "transparent" solution, but it is somewhat simple and shouldn't tax your fgt's resources.

Sign up

Login with SSO

Login to the community

Login with SSO