DNS Server not resolving internal IP's

[ForgetItNet]

Hi all,

I've never used the DNS server on Fortinets before but we've got 2 VLANS, a guest one and a DMZ one and i need to be able to set the devices on the guest network to use the fortinet (100F) as their DNS server so that i can set a domain like dmz.com and add an entry such as server.dmz.com (which is a device on our internal network on the DMZ vlan) so that instead of them going to 8.8.8.8 or 9.9.9.9 and then it giving them the WAN ip of the router (such as 22.22.22.22 that it then just directs them to the internal IP of the server such as 192.168.10.1. 

I've enabled the DNS server feature and then in the "DNS Service on Interface" i've selected the interface as the guest one and left it as "Recursive" with the DNS filter and DNS over HTTPS left off.

On the "DNS database" i've then created a new database for dmz.com and added an "Address (A)" type entry with the hostname as "server" so it's made the FQDN as server.dmz.com and then the IP address of 192.168.10.1 and left the TTL to "Use" Zone TTL and left the Status as on. 

I've then changed the DNS on the Guest DHCP to give out the Fortinet routers IP as the DNS (the Interface IP on the Guest VLAN) and then on a test client it then shows me the IP address it's got is on the Guest network with the DNS set to the VLAN IP of the gateway of the Guest network but if i then ping server.dmz.com it then gives me the external IP of the server (i.e 22.22.22.22) ?

I've flushed the DNS on the router using the "diagnose test application dnsproxy 1" command but it still resolves to the external IP.

Any help would be great.

Thanks

[hbac]

Hi @ForgetItNet,

Which DNS server is FortiGate using under Network > DNS? What is the DNS Forwarder under Network DNS Servers > DNS database? 

Regards, 

[ForgetItNet]

Hi hbac,

So the DNS servers are currently showing as "Use FortiGuard Servers" and set to 96.45.45.45 and 96.45.46.46 and the DNS forwarder currently under the database is set to 9.9.9.9 ?

Thanks

[hbac]

@ForgetItNet,

Based on your description, the configuration is correct. Can you check on the client side? What is the output of 'ipconfig /all' and 'nslookup' ?

Regards, 

[ForgetItNet]

So the IP address is correct for the guest network of 192.168.30.x and correct subnet mask of 255.255.255.0 along with the gateway of 192.168.30.1 (and I can browse the internet fine) and the DNS are set to 192.168.0.20 (which is the the router) but I've also set the secondary as 9.9.9.9...I've just removed the 9.9.9.9 so it HAS to use 0.20 but then it can't resolve server.dmz.com at all ?