Description
This article describes how to configure static DNS filter users which allows/blocks specific domains.
Scope
FortiGate.
Solution
Three types of URL can be defined.
- Simple: a simple URL-Filter entry could be a regular URL.
For example: www.fortinet.com
- URL: fortinet.com
- URL: fortinet.com/support
- Wildcard: a wildcard can be used to include one or more URLs to a simple URL
For example:
- URL: *.fortinet.com (everything before ".fortinet.com" will match this rule, like support.fortinet.com)
- URL: www.fortinet.com/* (everything after "www.fortinet.com/" will match this rule, like www.fortinet.com/contact)
- Regular Expressions (regex): regex is used to include one or more URLs related -or not related- to a pattern using some Perl syntax
For example:
- '*' symbol means: match 0 or more times of the character before the symbol, but no match with any character.
For example:'fortinet*.com' will match 'fortinetttttttt.com' but not 'fortinetsupport.com'.
'/i' symbols means: makes the pattern case sensitive.
For example:'/FORTINET/i' will not match with 'fortinet'.
'^' symbols means: at the beginning of the string.
For example:'^fo' will match 'fortinet.com'
'.' symbol means: match the same or different character than the one before the symbol, but is followed by the rest of the sentence.
For example:'fortinet.com' will match 'fortinetacom', 'fortinetbcom', 'fortinetzcom'.
Configuring a domain filter.
From GUI.
- Go to Security Profiles -> DNS filter.
- Select a profile to edit.
- Under Static Domain filter, select checkbox 'Domain Filter', and select 'Create New'
- Enter the URL, without the 'http', for example: www.example*.com.
- Select a Type: simple , regular Expression, or wildcard. In this example and select 'Wildcard'.
- Select the action to take against matching URLs: redirect to block portal, allow or monitor.
- Select 'Enable'.
- Select 'OK'.
Example:
From CLI.
config dnsfilter domain-filter
edit <ID>
set name <name>
config entries
edit <ID>
set domain <domain>
set type <simple/regex/wildcard>
set action <block/allow/monitor>
set status <enable/disable>
next
end
end
Note:
If the action is set to 'Redirect to Block Portal' for any domain then performing the 'nslookup' for that domain will give the IP 208.91.112.55 (fortinet-block-page-55.fortinet.com) if redirect portal IP is set to FortiGuard default in the DNS profile settings.
