Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mhdganji
Contributor

DNS Filtering not available in proxy policy rules

Hi,

In a VDOM used to proxy clients request (acts as a proxy server on 8080), although DNS filter is enabled in feature visibility, but is not displayed (everything is there, WAF, IPS, Web, ...) but DNS filter is not present

 

In the other VDOMs, such as a VDOM linked to the one mentioned above which has direct Internet access, DNS filter is present but as I said in Proxy polices in our Proxy VDOM serving clients request it is not present.

 

Thanks in advance for your help

 

Regards

1 Solution
pminarik

It is not that FortiOS explicit proxy doesn't support it, it is that proxy clients do not pass their DNS requests through the proxy. They don't resolve the FQDNs of websites requested through the proxy at all.

 

When a proxy client wants to connect to www.example.com through the proxy, it does not do any DNS lookup, it directly sends a request to the proxy:
GET http://www.example.com
or
CONNECT https://www.example.com

 

DNS lookup is then handled by the proxy itself. (so the proxy itself can connect to the desired server to facilitate the connection)

 

Feel free to install Wireshark on some test client of yours to verify this client behaviour yourself. Focus on DNS traffic (UDP/53) and proxy traffic (by default TCP/8080 in FortiOS, but maybe you changed it).

 

As such, try using webfilter profile in the proxy policy, making sure you're blocking the Malicious Websites category. I'm not sure if this is 100% the case, but I have checked a handful of FQDNs from the botnet list, and they were all categorized as "Malicious Websites" by the FortiGuard webfilter rating.

[ corrections always welcome ]

View solution in original post

16 REPLIES 16
Richie_C
Staff
Staff

Hi

 

DNS filter is not supported with Explicit Proxy. We can see the supported features in the following documentation.

 

https://docs.fortinet.com/document/fortigate/7.0.6/administration-guide/149927/proxy-policy-security...

 

Thanks

Richard 

mhdganji

Hi,

 

 I cannot figure out why this is not supported. The device is working as a proxy and does the query DNS task do it can do the filtering. Am I wrong here?

Richie_C

With explicit proxy, the FortiGate would be doing the DNS lookup and not the client. So a policy to scan DNS requests traversing the firewall wouldnt make sense.

mhdganji

Sorry for making it long but I still don't get it why it's not possible anyway. Let's assume the client is requesting xyz.net which is a C&C and there is a DNS filter on the policy. When the fortigate is serving the request, finds the DNS filter rule enabled and check the IP is in botnet database so it answers with the portal or any configured address. I know it sounds strange and not straight forward but seams feasible to implement. 

Richie_C

Firstly, i cannot comment precisely on why something is a feature or not.

 

I believe the scenario you refer to would be possible with a workaround. 1 example would be to use a second VDOM for the DNS filtering. 

 

mhdganji

I did this but not sure if you meant exactly the way I went

 

I created a second vdom, made a vdom link and forced the proxy requests go to the second one which is connected and NAT'ed directly

Then I defined a policy for the second one including DNS filter

 

not so customizable and selective but anyway it works for all the requests.

 

what do you think about the solution?

Richie_C

Yes, this is solution i was referring to. 

As always, it should be thoroughly tested to ensure it meets your needs. 

mhdganji

Thanks and BTW,

 

what if we use the device itself as the DNS server? Does fortigate (or is it possible to config it) apply DNS filtering rules when fetching results from its upstream servers?

Richie_C

Basically, the request has to pass through a firewall policy. If it passes through another VDOM, it will have to pass through another policy and DNS filter can be applied. If it goes out directly to the internet from the VDOM it will not have to match a policy and therefore you cannot apply the DNS profile.