Restricting DNS

[Lockout888]

New to Fortinet, but familiar with using other Firewalls.

I bought a Fortigate 60E with UTM license for home use, and I want to force my kids devices to use OpenDNS Family Shield DNS Servers, while allowing other devices to use regular DNS Servers.

I was able to do this with DD-WRT by using these commands:

iptables -t nat -I PREROUTING -i br0 -m mac --mac-source ##:##:##:##:##:## -p udp --dport 53 -j DNAT --to 208.67.222.123
iptables -t nat -I PREROUTING -i br0 -m mac --mac-source ##:##:##:##:##:## -p tcp --dport 53 -j DNAT --to 208.67.222.123

Even if the device changed DNS Servers manually, they were forced to use Family Shield.

How can I accomplish this with Fortinet?

[Dave_Hall]

This is doable.  If the kid devices do not have statically assigned IPs, you can enabled Device Detection on the internal interface - after that go into User & Devices->Device Inventory> and locate your kid device and create/added it to a custom group (aka Kids-devices).   When creating the firewall policy, choose the internal interface and set source to all and click on the device tab and select your kid devices group.  Set the service to DNS and dest address to both Open DNS server IPs.  Move this policy up in the firewall chain so it is triggered.  Follow this up with creating a similar firewall policy using the same kid devices group as source and set the service to DNS and action to block - move this firewall policy below the first one.

Edit: this solution is likely not idea if looking for a "transparent" solution, but it is somewhat simple and shouldn't tax your fgt's resources. 

[Leen]

Kids are smart these days,except for Iphone / Ipad any device can have their MAC address changed. They also could use a VPN, some browsers already have this build in.

Use your fortigate as DNS server for your internal network. set the DNS forwarding to the required DNS servers.

Create a Policy that blocks all DNS traffic.

Create another policy to block any application VPN, and also deny any tunneling protocols.