DNS Filter upon a Virtual Wire Pair Policy is broken

[absolute_mad_lad]

Hello,

I have the below configured as a rule for my Virtual Wire Pair Policy.

config firewall policy
    edit 23
        set name "VLAN13 Restricted DNS"
        set uuid 4f872b7a-3a70-51f0-ffbb-6d2a411e5d70
        set srcintf "internal4" "internal5" "internal2" "internal3"
        set dstintf "internal4" "internal5" "internal2" "internal3"
        set action accept
        set srcaddr "VLAN13 address space"
        set dstaddr "VLAN18 address space"
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set dnsfilter-profile "sample-filter"
        set logtraffic all
    next
end

With the above configuration, all DNS traffic is broken. I cannot even do the below dig command (192.168.100.1 is the IP address of this FortiGate, which is running a DNS server.

dig @192.168.100.1

If I remove the DNS Filter profile from the above, all DNS queries work fine.

My DNS filter looks like this. All I did in the GUI was to set "example.com" to Allow and then immediately after it, block all domains with an "*" wildcard. I tested this policy by applying it to the DNS service directly, and it worked completely fine there. It just seems to be broken when used on a Virtual Wire Pair Policy.

config dnsfilter profile
    edit "sample-filter"
        config domain-filter
            set domain-filter-table 1
        end
        config ftgd-dns
            set options error-allow ftgd-disable
            config filters
                edit 1
                    set category 12
                next
                edit 2
                    set category 2
                next
                edit 3
                    set category 7
                next
                edit 4
                    set category 8
                next
                edit 5
                    set category 9
                next
                edit 6
                    set category 11
                next
                edit 7
                    set category 13
                next
                edit 8
                    set category 14
                next
                edit 9
                    set category 15
                next
                edit 10
                    set category 16
                next
                edit 11
                    set category 57
                next
                edit 12
                    set category 63
                next
                edit 13
                    set category 64
                next
                edit 14
                    set category 65
                next
                edit 15
                    set category 66
                next
                edit 16
                    set category 67
                next
                edit 17
                    set category 26
                    set action block
                next
                edit 18
                    set category 61
                    set action block
                next
                edit 19
                    set category 86
                    set action block
                next
                edit 20
                    set category 88
                    set action block
                next
                edit 21
                    set category 90
                    set action block
                next
                edit 22
                    set category 91
                    set action block
                next
                edit 23
                next
            end
        end
        set log-all-domain enable
        set redirect-portal 192.168.254.254
    next 
end

 I am running on v7.6.3 build3510 (Feature) on a FortiGate-60F appliance. I will take any suggestions, I am completely blocked by this issue now. My end goal is to only allow a small fine grained list of domains, and then block all other DNS traffic, so I only need to use a static domain filter here.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

To troubleshoot a DNS filter issue on a virtual wire pair policy, follow these steps:

1. Verify FortiGuard SDNS Server Connection: Ensure the FortiGate can connect to the FortiGuard SDNS server using DNS over TLS (DoT, TCP port 853) and use the command:
   
   diagnose test application dnsproxy 3
   
   

Check for the SDNS server IP and ensure there are no connection failures.

2. Ping the SDNS Server: In the management VDOM, test connectivity to the SDNS server:
   
   execute ping <SDNS server IP>

3. Check FortiGuard License: Ensure the FortiGate has a valid FortiGuard web filter license.
4. Review DNS Filter Configuration: Verify the DNS filter settings in the FortiGate configuration to ensure they are correctly applied to the virtual wire pair policy.
5. Switch to Unicast if Necessary: If FortiGuard is not reachable using anycast, configure the default FortiGuard SDNS (unicast) server:

config system fortiguard
    set fortiguard-anycast disable
    set sdns-server-ip "208.91.112.220"
end

6. Re-verify SDNS Servers: Check the list of SDNS servers again to confirm the configuration:
   
   diagnose test application dnsproxy 3

[absolute_mad_lad]

Hi,

This is not relevant to my issue. I am not using the Fortinet DNS servers. I am using Quad9. My connectivity with Quad9 is perfect and has no issues. I have proven that the issue is not related to outbound upstream DNS connectivity, by nature of explaining that applying the DNS Filter policy works fine when applied to the DNS server running on the FortiGate. Filtering using a static domain list also is not dependent on any licencing. Additionally, my DNS traffic works completely fine without a DNS policy upon a Virtual Wire Pair, all machines are configured to use the FortiGate as their DNS server. There is only breakage when I apply the DNS Filter policy to the Virtual Wire Pair Policy - no DNS queries work in this scenario.