DNS Relay / Proxy

[TomWhi]

Hi,

I have been asked to setup a DNS relay/proxy on our FortiGate 1200D, this sits on the perimeter of the network and has access to the internet.  Currently we have internal DNS servers which go through the FortiGate to our ISP, however it'd be nicer / cleaner that the FortiGate does the requests and all of our internal servers point to the FortiGate to do lookups against the ISP and return them to our internal domain controllers / DNS servers. 

I can see how to setup a DNS Server - but this doesn't seem to suite my need. Unless I am using the wrong words in Google, other search engines and the FN Forum - I'm really struggling to find good documentation how to make my FG into a relay. 

Any help, advice or guides would be amazing.  Thank you. 

[AQ]

Hi Tom!!

Which version of FortiOS are you using?

If i understand good.. let ask if you are using DNS Database feature?

[TomWhi]

Hi,

I'm using 5.4.8.  We are not currently using the DNS Database feature. 

I have had a quick look and it seems that feature is what we'll need. I assume that I create a listener which is to the internal zones/interfaces that will listen to requests and then I can allow it to lookup locally, do a non-recursive or do a full recursive scan?  It looks like I'll set up full recursive which will look locally (I'll not have a local zone) so it'll use the DNS servers of my FortiGate to look externally...  Does that sound about right?

[ede_pfau · Accepted solution]

Hi,

could you please clarify when/whether you want to use the internal DNS additionally?

Usually, you keep the local names on a local Windows server. The DNS DB feature on a FGT is not full-fledged; for instance, it won't register hostnames on DHCP lease request (but the Win server will).

In this case, the name resolution would be:

- internal hosts ask the FGT

- the FGT's DNS is the internal server

- the server's DNS is the provider's DNS

...which is a pity as then an internal server would have to contact an external source, plus you will have to supply the IPS's DNS to the server setup.

Much more preferred would be:

- internal hosts ask the server (so they'll profit from auto-registration)

- the server's DNS is the FGT

- the FGT's DNS is the provider's DNS (automatically)

This way, the FGT will proxy external names only (whose resolution is 'costly'), and the only host asking the ISP will be the FGT. The ISP's DNS address will be automatically published to the FGT if it uses PPPoE or DHCP towards the ISP.

Additionally, you should DENY all DNS requests from your hosts into the WAN, to prevent fake DNS responses/phishing. The guy with the mis-configured PC or smartphone will call, believe me.

In short, the FGT will ALWAYS proxy DNS requests, without any further configuration. And some configs are 'safer' than others.

[TomWhi]

Hi

ede_pfau wrote:

could you please clarify when/whether you want to use the internal DNS additionally?

Actually - no - we don't want to use the internal DNS on the FortiGate, nor am I that bothered about the FortiGate using our internal Windows DNS servers (I'm happy that the FG's will just have external access). I think like you say I will keep my clients using the Windows DNS so that they automatically register via DHCP etc.

I think the second option that you have mentioned is what I will implement. 

ede_pfau wrote:

Much more preferred would be: - internal hosts ask the server (so they'll profit from auto-registration) - the server's DNS is the FGT - the FGT's DNS is the provider's DNS (automatically)

I have managed to setup a virtual lab to test this, and I think I understand it now and I'm pretty happy about putting it into production. I will also track firewall rules which are allowing DNS and politely asking the admins of each system to change their DNS servers to use my FG :) 

Thanks for your support.