DNS Filter Policy not working in Flow Mode Inspection - Has to be Proxy Mode

[DaveBaddorf]

Hello!  I just migrated most of the policies on a customer's 600E (7.4.8) from Proxy mode to Flow mode since only a few of the policies actually needed the Proxy mode to work (CDR & Video Filtering).  One of the rules that I tried to change from Proxy mode to Flow mode was a simple DNS rule that only does DNS filtering for DNS lookups to the Internet:

config firewall policy
    edit 117
        set name "DNS Filter - Testing"
        set uuid b4130862-7872-51f0-6074-01eb3ef19f90
        set srcintf ....
        set dstintf "virtual-wan-link"
        set action accept
        set srcaddr "laptop wifi"
        set dstaddr "all"
        set schedule "always"
        set service "DNS"
        set utm-status enable
        set inspection-mode proxy
        set dnsfilter-profile "DNS-Filter"
        set logtraffic all
        set nat enable
    next
end

When I change this rule to Flow, a select few DNS lookups resolve to FortiGuard's DNS Blocking page.  Yet, when I do these same DNS lookups using Proxy mode, they work just fine.  Here is an example of my nslookups:

Flow Mode:
C:\Users\dell>nslookup shop.bergeystruck.com. 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    shop.bergeystruck.com
Addresses:  2620:101:9000:53::55
          208.91.112.55   <-- FortiGuard DNS Blocking>

Proxy Mode:
C:\Users\dell>nslookup shop.bergeystruck.com. 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    shop.bergeystruck.com
Address:  104.211.61.142   <--- correct web page>

Anyone with any idea of why this is happening?  This doesn't make any sense to me.  The DNS Filter enforces SafeSearch, allows all categories [other than Malicious Websites], and has a few Static Domain Filters.

I appreciate any input!  

[AEK]

Hi Dave

Do you find any relevant info in the DNS logs?

You can also run DNS debug and reproduce the issue.

diagnose debug application dnsproxy 255
diagnose debug enable

[DaveBaddorf · Accepted solution]

Thanks, AEK.  While I was trying to figure out how to only show the DNS logging for one source IP or one Policy, I started wondering about the DNS filter that I was using on this policy.  Upon further investigation, one of the entries in the Static Domain Filter was "ru".  Presumably this was meant to be .ru, but with the entry as it was all domains which happened to have an "ru" in it (like www.virustotal.com) ended up being blocked.  For some reason this didn't happen with the policy in Proxy mode, but only in Flow mode.  Once removing this bogus "ru" entry, the DNS queries worked correctly in Flow mode.