DNS server on loopback not working after upgrade to 5.6.3
After upgrading from 5.4.5 to 5.6.3, the DNS service on a loopback interface is not working anymore. The traffic is arriving on the VDOM and the debug flow shows the traffic is accepted and sent to the loopback. However the DNS service itself does not reply. A wireshark shows exactly the same behavior, the packet is incoming on the VDOM, but there's no reply back. DNSproxy debugging shows:
Its interesting that you could reproduce the issue with a dual stack configuration. The odd thing is that in this environment there is no dual stack config, ipv6 is not used. I tried to reproduce the issue on my own FG with 5.6.3 but in this case DNS is responding, so its not clear how the issue is triggered, but it has to be a bug. Even if it would work again with reapplying the config, it doesn't feel like a safe solution for its purpose as it may just as well break again. I had to improvise with a workaround by shutting the loopback, then moving the DNS zone to a windows DNS server and using a VIP to make it reachable on the previous IP of the loopback int. Ill create a ticket and see if its a known issue. Thanks for your help!
For this issue I made a Fortinet ticket. As it turns out, there was a change of behavior in 5.6. There was a security flaw related to DNS in 5.4 which has been fixed. The consequence of this fix is that the DNS service has to be enabled also on the source interface receiving the DNS traffic. This is also why reproducing the issue at home was not successful for me, as DNS was enabled on my LAN also so I couldn't break it. After removing DNS on my local LAN, the DNS service on the Loopback interface indeed stopped responding. It still doesn't make that much sense to enable DNS as a service on the receiving interface, but it is the solution. Thanks for your help :)
Yes, I can confirm that the problem it's still present in FortiOS 6.2.2. / FGT80E. Thanks for sharing your solution with us.
I was about to bang my head on the wall after troubleshooting DNS issues with remote access tests using FortiClient.
DNS server was configured as an internal LAN IP interface and later I created a DNS server on a loopback interface. Traffic was flowing from by Forticlient laptop to the FGT80E v 6.2.2, but nothing was coming back.
I have tried using this command on the FGT : " diagnose sniffer packet any 'dst port 53' 4 20 a " and in the same time I was capturing traffic on the virtual interface on my laptop with Wireshark .. traffic hitting the FGT, not coming back.
in Windows command promot "nslookup yahoo.com 220.127.116.11" was working only using public DNS servers. FRUSTRATING !!
After creating DNS server also on the SSL VPN interface (ssl.root) and pointing remote access users to the loopback IP address - DNS service started to respond to requests. But it's slow on first request. After caching the results it's acceptable.
I know it is an old post but I read this one and after 6 hours troubleshooting I found an answer.
Starting from FortiOS version 5.6 onward, the DNS Server behavior was changed to drop DNS requests on interfaces not found in the dns-server table.
If a DNS Server is configured on an internal port, for example port1, then FortiGate will resolve only DNS queries coming over port1.If the DNS-server was configured on a loopback interface, but the DNS queries are reaching the FortiGate over a physical interface, in this example port1, then port1 must be added to the DNS-server table:
#config system dns-serveredit "DMZ-1"nextedit "DMZ-2"nextedit "port1"nextend
As stated in one of the first posts, "it's not a but, it's a feature!".
@FTNT: maybe there should be a hint added to the regular documentation (i.e. the Handbook) in the chapter on DNS servers. This would spare users, and eventually FTNT customer support, a lot of troubleshooting.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.