DNS Filtering not available in proxy policy rules

mhdganji · ‎07-11-2022

Hi,

In a VDOM used to proxy clients request (acts as a proxy server on 8080), although DNS filter is enabled in feature visibility, but is not displayed (everything is there, WAF, IPS, Web, ...) but DNS filter is not present

In the other VDOMs, such as a VDOM linked to the one mentioned above which has direct Internet access, DNS filter is present but as I said in Proxy polices in our Proxy VDOM serving clients request it is not present.

Thanks in advance for your help

Regards

M. Ganji, Network & Security Expert.

pminarik · ‎07-14-2022

It is not that FortiOS explicit proxy doesn't support it, it is that proxy clients do not pass their DNS requests through the proxy. They don't resolve the FQDNs of websites requested through the proxy at all.

When a proxy client wants to connect to www.example.com through the proxy, it does not do any DNS lookup, it directly sends a request to the proxy:
GET http://www.example.com
or
CONNECT https://www.example.com

DNS lookup is then handled by the proxy itself. (so the proxy itself can connect to the desired server to facilitate the connection)

Feel free to install Wireshark on some test client of yours to verify this client behaviour yourself. Focus on DNS traffic (UDP/53) and proxy traffic (by default TCP/8080 in FortiOS, but maybe you changed it).

As such, try using webfilter profile in the proxy policy, making sure you're blocking the Malicious Websites category. I'm not sure if this is 100% the case, but I have checked a handful of FQDNs from the botnet list, and they were all categorized as "Malicious Websites" by the FortiGuard webfilter rating.

[ corrections always welcome ]

View solution in original post

Richie_C · ‎07-14-2022

Hi

You could check out IPS for the that. See the following article:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-configure-Botnet-C-C-IP-blocking/ta-p/1979...

Thanks

Take a backup before making any changes