IPS Signature to block DNS registration?

[burtmianus]

Ahoy,

So we're deploying an IPSec dialup design using Forticlient and one of the slightly irritating issues I have found is that when it connects not only does the Forticlient virtual adapter's IP address register on our AD domain DNS servers, but so does the physical LAN/WLAN adapter on the client itself. We end up with 2 IPs with a 50-50 chance of DNS resolving to the right one when required, and if you get the wrong one you can't reach the client as the IP address doesn't exist in our routing table, or more worryingly (if they are a nerd and have re-done their home LAN) a duplicate IP for something on our range....

Spoke to our SE and he asked around and apparently it isn't possible to stop it out of the box, it is possible to script it on the client (run script to first disable DNS reg on local adapter, then script launches VPN, user does their task and then runs a second script to disconnect the VPN and turn on DNS registration again), but that's messy. Looking at it, what happens is that when you connect to the VPN the FC overwrites the DNS server addresses on your local adapter with the ones you specify in the config, these also are applied to the virtual adapter. If they were to modify the design and set the metric on the adapter to something like 1 rather than 20, it would most likely be lower than the LAN's default 10 (unless changed by you), then also remove the feature that overwirtes the DNS servers on the LAN adapter. This would mean that the FC virtual adapter would be the first one used, all DNS would go down the tunnel granted, but splitt tunnelling would deal with traffic and its stop 2 IPs being registered.

Anyway, on to the actual idea he gave me: using a custom IPS signature to block DNS from the LAN adapter over the VPN tunnel but not the virtual adapter. I think this would do it:

set signature "F-SBID( --name "IPSec-Client.DNS-Block"; --service DNS; --src_addr ![10.220.0.0/16,10.221.0.0/16];

however, that's a bit heavy handed - does anyone know if it is possible to use IPS to block the packets that are involved in registering an adapter's IP in DNS? i.e. using the UDP Header options to identify the specific packet and then have the IPS sig trigger a block? Problem is i can't find info on what part of the packet specifically it is and even if I could I can't see how to add it to the sig i have made...

Any ideas peeps?

Ta

[burtmianus]

Update - that IPS sig doesn't work as the traffic is coming in on the IPSec virtual interface with an IP in the ranges excluded (10.220.0.0/16 & 10.221.0.0/16).

Seems we'd need something that could read the contents of the UDP packets to find the IP address it mentions and block it if not in that range.... sounds a bit pie in the sky....