[solved]How can I get DNS server from WAN intferface on my DHCP service ?

[#1]

Hi, I got a Fortigate 50B with WAN1 interface connected to my ADSL modem. WAN1 interface get its IP address, default gateway, and DNS server from the DHCP service of my ADSL modem : (say for instance 192.168.1.34, 192.168.1.1, 192.168.1.1 / 255.255.255.0). Now, I created 1 VLAN " 70" on Internal interface and set an static IP address (say 192.168.70.1 / 255.255.255.0). Because I' m going to connect dumb workstations on this VLAN, I want a DHCP service to kick their... IP address, gateway, and DNS ;) So I configured a DHCP server on my VLAN interface " 70" via System > DHCP > Services. But the thing is puzzling me is how can I get this Fortigate unit to do the following simple job : get the DNS server from the WAN1 interface and use it as DNS Server for my DHCP service of my VLAN " 70" . I thought that marking the options " Retrieve default gateway from server" and " Override internal DNS" on WAN1 interface would solve my problem. Ok the default gateway work fine. My ping packets go where I want they go. But for my DNS queries, forget it ! It won' t work. Guess what... The workstations don' t get any DNS server during the DHCP query process unless I put by myself something in the field " Advanced" > " DNS Server 1" of my DHCP service. So if anybody got an idea on how to proceed, she is more than welcome. Because I got many VLAN interfaces to configures and the workarround I found is not dynamic if the DNS config of my ADSL modem change.

[rwpatterson]

Welcome to the forums. What you' re trying to do is rather simple in concept, but has a couple of steps in implementing. 1) Create a Virtual IP definition. Map an IP on the VLAN to the default gateway on the LAN. You could use the default gateway IP IF you port forward the VIP definition. 2) Create a policy allowing DNS from the VLAN to the LAN, source VLAN subnet, destination the default gateway for the LAN service DNS. In this way, DNS requests go to a virtual IP in the VLAN, and it' s transferred over to the DNS listener on the LAN that already exists. Good luck.

[#3]

Thanks for your quick answer Ok I don' t understand everything :

Map an IP on the VLAN to the default gateway on the LAN.

What dou you mean ? Which menu to do that ? I' ve already heard abour virtual IP (is it loopback address ?), I will look up how to create this. Thanks

[rwpatterson]

A Virtual IP is the way the FGT maps an IP to a server or subnet on a different interface. You would be mapping the DNS server on the internal subnet to the VLAN for use.

[#5]

Ok I did this : Firewall > Virtual IP Name : DNS VLAN Data External Interface : internal Type : Static NAT (no other choice) External IP : 192.168.2.1 (my internal LAN is 192.168.2.0/24) Mapped IP Address/Range 192.168.70.2 Firewall > Policy Source address : all Destination address : Internal DNS service / Default gateway (that is 192.168.2.1/255.255.255.0 on internal) Schedule : always Service : dns ( I tried as well with " ANY" ) Action : accept no other options ticked/marked (NAT, ...). System > DHCP Name : VLAN Data DHCP Server IP Range : 192.168.70.51 to 254 Network mask : 255.255.255.0 Default gateway : 192.168.70.1 DNS Server 1 : 192.168.70.2 That' s all. Unfortunately it' s not working

[rwpatterson]

ORIGINAL: Jacknight Firewall > Policy Source address : all Destination address : DNS VLAN Data Schedule : always Service : dns ( I tried as well with " ANY" ) Action : accept

[#7]

I read again and again and again differents explanations and exemple about Virtual IP and I finaly understood it. And understood what I did wrong. In fact I messed everything. Config must be this way to work : DHCP config was correct.

Firewall > Virtual IP Name : DNS VLAN Data External Interface : VLAN Data Type : Static NAT (no other choice) External IP : 192.168.70.2 Mapped IP Address/Range : 192.168.2.1 Firewall > Policy Source interface VLAN Data Source address : all Destination Interface : internal Destination address : VLAN Data DNS Schedule : always Service : DNS Action : accept

Thanks a lot for your advices rwpatterson