DNS Filtering not available in proxy policy rules

[mhdganji]

Hi,

In a VDOM used to proxy clients request (acts as a proxy server on 8080), although DNS filter is enabled in feature visibility, but is not displayed (everything is there, WAF, IPS, Web, ...) but DNS filter is not present

In the other VDOMs, such as a VDOM linked to the one mentioned above which has direct Internet access, DNS filter is present but as I said in Proxy polices in our Proxy VDOM serving clients request it is not present.

Thanks in advance for your help

Regards

[Richie_C]

Hi

DNS filter is not supported with Explicit Proxy. We can see the supported features in the following documentation.

https://docs.fortinet.com/document/fortigate/7.0.6/administration-guide/149927/proxy-policy-security...

Thanks

Richard 

[mhdganji]

Hi,

 I cannot figure out why this is not supported. The device is working as a proxy and does the query DNS task do it can do the filtering. Am I wrong here?

[Richie_C]

With explicit proxy, the FortiGate would be doing the DNS lookup and not the client. So a policy to scan DNS requests traversing the firewall wouldnt make sense.

[mhdganji]

Sorry for making it long but I still don't get it why it's not possible anyway. Let's assume the client is requesting xyz.net which is a C&C and there is a DNS filter on the policy. When the fortigate is serving the request, finds the DNS filter rule enabled and check the IP is in botnet database so it answers with the portal or any configured address. I know it sounds strange and not straight forward but seams feasible to implement. 

[Richie_C]

Firstly, i cannot comment precisely on why something is a feature or not.

I believe the scenario you refer to would be possible with a workaround. 1 example would be to use a second VDOM for the DNS filtering. 

[mhdganji]

I did this but not sure if you meant exactly the way I went

I created a second vdom, made a vdom link and forced the proxy requests go to the second one which is connected and NAT'ed directly

Then I defined a policy for the second one including DNS filter

not so customizable and selective but anyway it works for all the requests.

what do you think about the solution?

[Richie_C]

Yes, this is solution i was referring to. 

As always, it should be thoroughly tested to ensure it meets your needs. 

[mhdganji]

Thanks and BTW,

what if we use the device itself as the DNS server? Does fortigate (or is it possible to config it) apply DNS filtering rules when fetching results from its upstream servers?

[Richie_C]

Basically, the request has to pass through a firewall policy. If it passes through another VDOM, it will have to pass through another policy and DNS filter can be applied. If it goes out directly to the internet from the VDOM it will not have to match a policy and therefore you cannot apply the DNS profile.