Redirect all DNS requests to local server

[Anders_Jensen]

Hi, i am running a closed network for exam purposes in a school. I have a DHCP-server that hands out ip-adresses along with the IP of my local DNS-server. I see more and more of the students having there own static DNS-servers (openDNS, GoogleDNS and so on), which means that they are not able to connect to my internal print-solution. Can a Fortigate somehow redirect all DNS requests to my own internal server, so I dont have to instruct the students in removing the static DNS and use mine every time we have exams? Regards Anders

[rwpatterson]

Welcome to the forums. One way to do it (very brute force, but it should work) would be to create virtual IPs for those external DNS servers, and point then to your DNS servers. You know 8.8.8.8 and 8.8.4.4 are Google servers. A VIP policy would take that traffic and send it to your DNS server without them knowing. The only issue here is that you would have to do this with every public DNS server out there. (at least the common ones) Not ideal, but doable. This is my first thought without thinking too deeply. There' s more than likely a couple other ways to get this done as well.

[networkingkool]

ORIGINAL: rwpatterson Welcome to the forums. One way to do it (very brute force, but it should work) would be to create virtual IPs for those external DNS servers, and point then to your DNS servers. You know 8.8.8.8 and 8.8.4.4 are Google servers. A VIP policy would take that traffic and send it to your DNS server without them knowing. The only issue here is that you would have to do this with every public DNS server out there. (at least the common ones) Not ideal, but doable. This is my first thought without thinking too deeply. There' s more than likely a couple other ways to get this done as well.

Hi Bob, I ' m getting in your technique but it does not work for me, maybe I wrong somewhere. Do you mean creating a virtual IP with settings: external interface: LAN (internal), External IP: 8.8.8.8, Mapped IP: my local DNS IP, no port forwarding; then creating a firewall policy to refer that virtual IP?

[emnoc]

And simpler can' t you just creat a fwpolicy that block DNS request to anything except your local server(s). config firewall policy edit 0 set srcintf " LAN" set dstintf " EXT_NET01" set srcadd " LAN" set dstadd " ANY" set service " DNS" set comments " block deny servers outside of network" next end and make sure to install this at the top of your pecking order and if you need another fwpolicies to allow the lan to another interface, make sure you add that. This would prevent them outside and make them have to use your dhcp-provided servers.

[rwpatterson]

ORIGINAL: emnoc And simpler can' t you just creat a fwpolicy that block DNS request to anything except your local server(s).

If the DNS server is hard coded, wouldn' t that then fail? You can have the Windows IP stack DHCP assign an IP address, but still override the DNS servers. You would still need to tell the end users what to do. (In my opinion...) Not sure if DNS needs the server specified, or if anything that works on port 53 would do.

[Dave_Hall]

I had to actually set something up like this as a temp solution at one of the remote sites we manage. It seems the customer' s ISP was experiencing DNS issues, and because the site' s 200+ workstations were configured with static IP settings, we had to " hard-code" a temp solution into their fgt. As Robert indicated we set up a VIP with a Source Address Filter that pretty much redirected all port 53 traffic to another IP. (I believe/recall the Fortigate handbook gave something similar -- used in a VPN setup -- with a web server --- redirecting internal port 8080 traffic to port 80 in a DMZ zone.)

[Dave_Hall]

Mind you this was like 18 months ago, but when I did the DNS hack for the customer, their IT admin didn' t report any issues except that their Windows 7-based machines reported their connection down but they could still surf. Looking back now-- I am guessing those machines couldn' t reach www.msftncsi.com

[emnoc]

imho If you use the VIP approach, you have no way of catching all DNS servers. Make then break DNS lookups and then fix them by having the users use the local-dhcp-server-assigned nameservers. Most proper setup DNS server, will only allow recursive lookup from a trusted network source unless that DNS is open ( i.e our googles dns-server ) Trying to apply a band-aid on top of another band-aid, is not a good approach or best practice. If they are dynamic assigned for ip_addr and name/win server & for a reason, then enforce them to use dynamic assignments.

[rwpatterson]

My sentiments as well. I [would] block all DNS servers except those used by the institution. Maybe a pain now, but once running, problems will be few.

[Dave_Hall]

My sentiments as well. I [would] block all DNS servers except those used by the institution.

I heartily agree. The example I have used was only a temp solution, and was in place for a few hours until the ISP got their act together and fixed their DNS. (Which they didn' t and the long term solution was to install a local DNS server and directed their DNS quires to my company' s own DNS server.) Another good point about locking down DNS is that it prevents individuals from proxying web traffic and/or other non-DNS traffic through that port -- something we have discovered at some of our remote site, were doing.