Preventing my users from bypassing DNS settings to surf Internet

[BretPenz]

In a highschool environment with Fortinet Firewall.  Recently, I am discovering that students are bypassing the DNS settings provided through my Dhcp server by configuring their own laptops  (usually google 8.8.8.8. or some other DNS).   This allows them to bypass all web filtering while still using our Internet pipe.   Is there a quick easy way to configure the FORTINET FIREWALL to prevent anyone in the building from accessing the internet unless they are using an IP provided through our own DHCP?    Typically,  I have 2 internal DNS/ DHCP windows 2008 servers that should be funnelling all traffic to the firewall.   Somehow my firewall is accepting any IP traffic?  

I'm new to the fortinet family so any simple suggestions or ideas are greatly appreciated.

Thanks. 

[PC]

Could you start with a firewall rulebase that only allows your DNS servers to go out for DNS? You will still have other battles with proxy etc. but it will stop their simple DNS lookups.


From: Brett D Penza via Firewall: [mailto:firewall@lists.fusecommunity.fortinet.com]
Sent: Thursday, January 11, 2018 10:35 AM
To: firewall@lists.fusecommunity.fortinet.com
Subject: [Firewall:] - Preventing my users from bypassing DNS settings to surf Internet


In a highschool environment with Fortinet Firewall. Recently, I am discovering that students are bypassing the DNS settings provided through my Dhcp server by configuring their own laptops (usually google 8.8.8.8. or some other DNS). This allows them to bypass all web filtering while still using our Internet pipe. Is there a quick easy way to configure the FORTINET FIREWALL to prevent anyone in the building from accessing the internet unless they are using an IP provided through our own DHCP? Typically, I have 2 internal DNS/ DHCP windows 2008 servers that should be funnelling all traffic to the firewall. Somehow my firewall is accepting any IP traffic?

I'm new to the fortinet family so any simple suggestions or ideas are greatly appreciated.

Thanks.

-----End Original Message-----

[BretPenz]

That sounds like a good start.

How do I set that up? I have a Fortigate 81E.


Brett Penza
Technology Director/ Instructor
Holy Name Central Catholic Jr. Sr. High School
144 Granite Street
Worcester, MA 01604
bpenza@holyname.net
(508) 753-6371


________________________________
From: Peter Cook via Firewall:
Sent: Thursday, January 11, 2018 10:39 AM
To: firewall@lists.fusecommunity.fortinet.com
Subject: [Firewall:] - RE: Preventing my users from bypassing DNS settings to surf Internet


Could you start with a firewall rulebase that only allows your DNS servers to go out for DNS? You will still have other battles with proxy etc. but it will stop their simple DNS lookups.





From: Brett D Penza via Firewall: [mailto:firewall@lists.fusecommunity.fortinet.com]
Sent: Thursday, January 11, 2018 10:35 AM
To: firewall@lists.fusecommunity.fortinet.com
Subject: [Firewall:] - Preventing my users from bypassing DNS settings to surf Internet



In a highschool environment with Fortinet Firewall. Recently, I am discovering that students are bypassing the DNS settings provided through my Dhcp server by configuring their own laptops (usually google 8.8.8.8. or some other DNS). This allows them to bypass all web filtering while still using our Internet pipe. Is there a quick easy way to configure the FORTINET FIREWALL to prevent anyone in the building from accessing the internet unless they are using an IP provided through our own DHCP? Typically, I have 2 internal DNS/ DHCP windows 2008 servers that should be funnelling all traffic to the firewall. Somehow my firewall is accepting any IP traffic?

I'm new to the fortinet family so any simple suggestions or ideas are greatly appreciated.

Thanks.



-----End Original Message-----

-----End Original Message-----

[PC]

http://cookbook.fortinet.com/creating-security-policies-54/

In step 1 don't include DNS and have
Add a second policy similar to steps 3 and 4 where you define your DNS servers then add them to a policy allowing DNS out



From: Brett Penza via Firewall: [mailto:firewall@lists.fusecommunity.fortinet.com]
Sent: Thursday, January 11, 2018 2:26 PM
To: firewall@lists.fusecommunity.fortinet.com
Subject: [Firewall:] - RE: Preventing my users from bypassing DNS settings to surf Internet


That sounds like a good start.

How do I set that up? I have a Fortigate 81E.


Brett Penza
Technology Director/ Instructor
Holy Name Central Catholic Jr. Sr. High School
144 Granite Street
Worcester, MA 01604
bpenza@holyname.net<mailto:bpenza@holyname.net>
(508) 753-6371

________________________________
From: Peter Cook via Firewall: >">mailto:firewall@lists.fusecommunity.fortinet.com>>
Sent: Thursday, January 11, 2018 10:39 AM
To: firewall@lists.fusecommunity.fortinet.com<mailto:firewall@lists.fusecommunity.fortinet.com>
Subject: [Firewall:] - RE: Preventing my users from bypassing DNS settings to surf Internet


Could you start with a firewall rulebase that only allows your DNS servers to go out for DNS? You will still have other battles with proxy etc. but it will stop their simple DNS lookups.





From: Brett D Penza via Firewall: [mailto:firewall@lists.fusecommunity.fortinet.com]
Sent: Thursday, January 11, 2018 10:35 AM
To: firewall@lists.fusecommunity.fortinet.com<mailto:firewall@lists.fusecommunity.fortinet.com>
Subject: [Firewall:] - Preventing my users from bypassing DNS settings to surf Internet



In a highschool environment with Fortinet Firewall. Recently, I am discovering that students are bypassing the DNS settings provided through my Dhcp server by configuring their own laptops (usually google 8.8.8.8. or some other DNS). This allows them to bypass all web filtering while still using our Internet pipe. Is there a quick easy way to configure the FORTINET FIREWALL to prevent anyone in the building from accessing the internet unless they are using an IP provided through our own DHCP? Typically, I have 2 internal DNS/ DHCP windows 2008 servers that should be funnelling all traffic to the firewall. Somehow my firewall is accepting any IP traffic?

I'm new to the fortinet family so any simple suggestions or ideas are greatly appreciated.

Thanks.


-----End Original Message-----

-----End Original Message-----

[BretPenz]

Very good, Thanks very much.

This should help me out quite a bit. (and make a few lazy students pretty unhappy).

Great.

-Brett


Brett Penza
Technology Director/ Instructor
Holy Name Central Catholic Jr. Sr. High School
144 Granite Street
Worcester, MA 01604
bpenza@holyname.net
(508) 753-6371


________________________________
From: Peter Cook via Firewall:
Sent: Thursday, January 11, 2018 2:31 PM
To: firewall@lists.fusecommunity.fortinet.com
Subject: [Firewall:] - RE: Preventing my users from bypassing DNS settings to surf Internet


http://cookbook.fortinet.com/creating-security-policies-54/


In step 1 don’t include DNS and have

Add a second policy similar to steps 3 and 4 where you define your DNS servers then add them to a policy allowing DNS out







From: Brett Penza via Firewall: [mailto:firewall@lists.fusecommunity.fortinet.com]
Sent: Thursday, January 11, 2018 2:26 PM
To: firewall@lists.fusecommunity.fortinet.com
Subject: [Firewall:] - RE: Preventing my users from bypassing DNS settings to surf Internet



That sounds like a good start.

How do I set that up? I have a Fortigate 81E.



Brett Penza

Technology Director/ Instructor

Holy Name Central Catholic Jr. Sr. High School

144 Granite Street

Worcester, MA 01604

bpenza@holyname.net<mailto:bpenza@holyname.net>

(508) 753-6371



________________________________

From: Peter Cook via Firewall: >">mailto:firewall@lists.fusecommunity.fortinet.com>>
Sent: Thursday, January 11, 2018 10:39 AM
To: firewall@lists.fusecommunity.fortinet.com<mailto:firewall@lists.fusecommunity.fortinet.com>
Subject: [Firewall:] - RE: Preventing my users from bypassing DNS settings to surf Internet



Could you start with a firewall rulebase that only allows your DNS servers to go out for DNS? You will still have other battles with proxy etc. but it will stop their simple DNS lookups.





From: Brett D Penza via Firewall: [mailto:firewall@lists.fusecommunity.fortinet.com]
Sent: Thursday, January 11, 2018 10:35 AM
To: firewall@lists.fusecommunity.fortinet.com<mailto:firewall@lists.fusecommunity.fortinet.com>
Subject: [Firewall:] - Preventing my users from bypassing DNS settings to surf Internet



In a highschool environment with Fortinet Firewall. Recently, I am discovering that students are bypassing the DNS settings provided through my Dhcp server by configuring their own laptops (usually google 8.8.8.8. or some other DNS). This allows them to bypass all web filtering while still using our Internet pipe. Is there a quick easy way to configure the FORTINET FIREWALL to prevent anyone in the building from accessing the internet unless they are using an IP provided through our own DHCP? Typically, I have 2 internal DNS/ DHCP windows 2008 servers that should be funnelling all traffic to the firewall. Somehow my firewall is accepting any IP traffic?

I'm new to the fortinet family so any simple suggestions or ideas are greatly appreciated.

Thanks.



-----End Original Message-----



-----End Original Message-----

-----End Original Message-----