Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Is it possible to redirect all DNS traffic to a particular external provier

I know I can DENY all outbound DNS traffic to port 53 tcp/udp and then just add an allow for our vendor's DNS servers. However, my vendor recommends redirecting all DNS traffic - which does sound like a more elegant solution if the FortiOS can handle it.


Does anyone have any suggestions on how the following might be done on a Fortigate? If relevant, we run a mix of 5.2/5.4, primarily the FG-60 series (D,E).


Snippet from my vendor's docs (DNSFilter):

Using iptables, the most common firewall on Linux systems, the rules in a config file look like this:
-A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination
-A OUTPUT -p tcp -m tcp --dport 53 -j DNAT --to-destination
Or, using the command line to add the rules: 
iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to
iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to


New Contributor III

Scott, this is possible with a VIP.  All DNS traffic destined for any external IP is remapped to a single DNS server you define, seamless to the user.  See the config below to get this to work.  This was tested on 6.0.2 and 5.6.x, you will have to test on your older firewall firmware revisions.  Just swap out my interface names with the ones you utilize.  I believe you can adjust the VIP extinf setting to "any" if you need to apply the VIP policy to multiple internal interfaces.


config system interface     edit "wifi-tunnel"         set vdom "root"         set ip     next end config firewall vip     edit "dns-vip"         set type load-balance         set src-filter ""         set extip         set extintf "wifi-tunnel"         set service "DNS"         set arp-reply disable         set mappedip ""     next end config firewall policy     edit 9         set srcintf "wifi-tunnel"         set dstintf "wan1"         set srcaddr "internal-net"         set dstaddr "dns-vip"         set action accept         set schedule "always"         set service "DNS"         set nat enable     next     edit 8         set srcintf "wifi-tunnel"         set dstintf "wan1"         set srcaddr "internal-net"         set dstaddr "all"         set action accept         set schedule "always"         set service "ALL"         set nat enable     next end


New Contributor hello im new here and im actually trying to stop my android from beind dns redirected i found thesr files on my sytem which led me to this site where I found information on dns filtering im really stressed out and i need a little help to fix this a little please can someone contact me and maybe tell me things to help me out please i dont know why they chose me to redirect my dns. Im just an old unemployed army vetran who was homeless for ten years so im nobody important and i have no money so why was my phone chosen. i apreciate any good advice please 


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors