Jump to:navigation, search
Wiki

DNS Relay

From Securepoint Wiki





notempty
Dieser Artikel bezieht sich auf eine nicht mehr aktuelle Version!

notempty
Der Artikel für die neueste Version steht hier

notempty
Zu diesem Artikel gibt es bereits eine neuere Version, die sich allerdings auf eine Beta-Version bezieht



























































































Forwarding DNS requests for the domain to the DNS server through the VPN tunnel

Last adaptation to the version: 12.6.1

New:
  • Updated to Redesign of the webinterface
  • Paketfilterregel Quelle und Ziel korregiert
notempty
This article refers to a Beta version
Access: UTM-IP:Port or UTM-URL:Port
Port as configured at Network / Appliance Settings / Webserver
Default-Port: 11115
i.e.: https://utm.ttt-point.de:11115
Default: https://192.168.175.1:11115 Applications Nameserver


Introduction

In this scenario, the UTM and clients of a remote site are to be connected to the domain at the main site.

  • All DNS requests for the domain to the DNS server, through the VPN tunnel, are forwarded to the main site.
  • The UTM shall provide DNS for the clients in the remote site.
  • Requests for the domain network shall be forwarded in the VPN tunnel to the DNS server in the main site.



Creating the DNS Relay Zone

In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden








Set Firewall as Namesever

Server settings UTMuser@firewall.name.fqdn Network
Nameserver IP

The first step is to define the UTM itself as the nameserver of the firewall.

  1. Configuration under Network Server settings Area Server settings section
    DNS Server
  2. Field Primary nameserver set the IP to 127.0.0.1 (localhost) as IP.
  3. Save with
  • If no nameserver is stored, DNS queries are resolved via the root DNS servers and the DNS servers stored there for the top-level domains



    • Create DNS Relay

    Applications Nameserver Area Zones
    The next step is to create a relay zone.













    Nameserver UTMuser@firewall.name.fqdnApplications
    Step 1
    • Open the Zones tab in the Nameserver window.
    • Click on the Add Relay Zone button to create a new relay zone
    Relay-Zone hinzufügen UTMuser@firewall.name.fqdnApplicationsNameserver
    Step 2
  • Under Zone name: enter the desired domain name
  • Select as Type: Relay
  • Click on the Add Server button to enter the IP address of the nameserver
    • Add server UTMuser@firewall.name.fqdnApplicationsNameserverRelay-Zone hinzufügen
    Step 3
  • Under IP address: the IP address of the remote nameserver is entered
    • Relay-Zone hinzufügen UTMuser@firewall.name.fqdnApplicationsNameserver
    Step 4
    View of the finished relay zone.
    In order to use this, Save and close the dialog Add Relay Zone and the dialog Nameserver.

    After creating the relay zone, the firewall forwards all requests to the DNS server at the main site on the domain network.



    DNS Relay for an IPSec Site-to-Site Tunnel

    In order to forward internal domain requests to a remote nameserver that is on an IPSec network, note that by default, all direct requests addressed to external nameservers are sent from the firewall with the external IP. However, a public IP is not routed into an IPSec tunnel.

    Create network object

    Firewall Network objects
    The packet filter rules in the Implied rules are automatically activated. This means that no network object is yet available for the IPSec network.

    The following objects are preconfigured at delivery: Network object associated interface object Network objects UTMuser@firewall.name.fqdn Firewall Update rules
    Overview of network objects
     Internet  external-interface
     internal-network  internal-interface
    only with min. 3 existing interfaces  dmz1-network  dmz1-interface
    In order to create the appropriate network object, click on the Network objects button under the Add object tab.
    Caption Value Description Add network objects UTMuser@firewall.name.fqdn Firewall Network objects
    Name: IPSec-Network Name for the IPSec network
    Type: VPN-Network Choose VPN network
    Address: 192.168.8.0/24 IP address of the IPSec network
    Zone: vpn-ipsec Select the corresponding VPN IPSec zone
    Groups:     a corresponding group can be entered

    Click Save, or Save and Close to save this network object.
    After the network object is created, Update rule is clicked.



    Create a rule

    Firewall Packetfilter button Add rule
    The last step is to create a firewall rule with a Hide NAT.
    This causes DNS forwarding to also go to the tunnel and not directly to the Internet.

    Caption Value Add rule UTMuser@firewall.name.fqdn Firewall Packetfilter
    Creating the rule
    Active: On
    Source:  external-interface
    Destination:  IPSec-Network
    Service:  domain-udp
    Action: ACCEPT
    [-] NAT
    Type: HIDENAT
    Network object:  internal-interface

    Click Save or Save and Close to save this rule.
    With this rule, all domain UDP requests made through the firewall to the remote nameserver are natted over the IP of the internal interface and can thus be routed into the IPSec tunnel.

    notempty
    Wenn Multipath Routing konfiguriert ist, muss für jedes externe Interface eine solche Regel angelegt werden.


    DNS Relay for an OpenVPN Site-to-Site Tunnel

    In order to forward internal domain requests to a remote nameserver located in an OpenVPN network, note that by default all direct requests directed to external nameservers are send from the firewall with the external IP. However, a public IP is not routed into an OpenVPN tunnel.


    Create zone

    Network Zone settings
    In order to route the DNS requests into the OpenVPN tunnel, a new interface zone must be created on the UTM.
    A new zone is created with the Add zone button.

    Caption Value Description Add zone UTMuser@firewall.name.fqdn Network Zone settings
    Dialog Add zone with flag Interface
    Name: Site-to-Site-DNS-Relay Name for the interface zone
    Interface: tun0 Select the corresponding interface tunX
    Interface: On Enable FLAG Interface for this zone


    Create Open-VPN network objects

    Firewall Network objects
    The packet filter rules in the Implied rules are automatically activated. This means that no network object is yet available for the Open-VPN network.

    The following objects are preconfigured at delivery: Network object associated interface object Network objects UTMuser@firewall.name.fqdn Firewall Update rules
    Overview of network objects
     Internet  external-interface
     internal-network  internal-interface
    only with min. 3 existing interfaces  dmz1-network  dmz1-interface
    In order to create the appropriate network object, click on the Network objects button under the Add object tab.
    Caption Value Description Add network objects UTMuser@firewall.name.fqdn Firewall Network objects
    Name: DNS-Relay-Interface Name for the Open VPN network
    Type: Dynamic interface Select dynamic interface
    Interface: 0.0.0.0/0 select this interface
    Zone: Site-to-Site-DNS-Relay Select the corresponding Open VPN zone
    Groups:     a corresponding group can be entered

    Click Save, or Save and Close to save this network object.
    After the network object is created, Update rule is clicked.


    Create rule

    Firewall Packetfilter button Add rule
    The last step is to create a firewall rule with a Hide NAT.
    This causes DNS forwarding to also go to the tunnel and not directly to the Internet.

    Caption Value Add rule UTMuser@firewall.name.fqdn Firewall Packetfilter
    Creating the rule
    Active: On
    Source:  DNS-Relay-Interface
    Destination: Remote-DNS-Server
    Service: dns
    Action: ACCEPT
    [-] NAT
    Type: HIDENAT
    Optional if domain controller does not want to respond to requests from the transfer network
    Network object:  internal-interface

    Click Save or Save and Close to save this rule.


    DNS Relay for a WireGuard Site-to-Site Tunnel

    The internal domain requests can also be forwarded to a remote nameserver located in a WireGuard network. The configuration of such a scenario requires an existing WireGuard site-to-site VPN (S2S) connection.


    Create zone

    Network Zone settings button Add zone
    In order to route the DNS requests into the WireGuard tunnel, a new interface zone must be created on the UTM.

    Caption Value Description Add zone UTMuser@firewall.name.fqdn Network Zone settings
    Dialog Add zone with flag Interface
    Name: WireGuard-S2S-DNS-Relay Name for the interface zone
    Interface: wg0 Select the corresponding WireGuard interface wg0
    Interface: On Enable FLAG Interface for this zone


    Create WireGuard network objects

    Firewall Network objects
    The packet filter rules in the Implied rules are automatically activated. This means that no network object is yet available for the WireGuard network.

    The following objects are preconfigured at delivery: Network object associated interface object Network objects UTMuser@firewall.name.fqdn Firewall Update rules
    Overview of network objects
     Internet  external-interface
     internal-network  internal-interface
    only with min. 3 existing interfaces  dmz1-network  dmz1-interface
    In order to create the appropriate network object, click on the Network objects button under the Add object tab.
    Caption Value Description Add network objects UTMuser@firewall.name.fqdn Firewall Network objects
    Name: WireGuard-DNS-Relay-Interface Name for the WireGuard network
    Type: Dynamic interface Select dynamic interface
    Interface: 0.0.0.0/0 select this interface
    Zone: WireGuard-S2S-DNS-Relay Select the corresponding WireGuard zone
    Groups:     a corresponding group can be entered

    Click Save, or Save and Close to save this network object.
    After the network object is created, Update rule is clicked.


    Create rule

    Firewall Packetfilter button Add rule
    The last step is to create a firewall rule with a Hide NAT.
    This causes DNS forwarding to also go to the tunnel and not directly to the Internet.

    Caption Value Add rule UTMuser@firewall.name.fqdn Firewall Packetfilter
    Creating the rule
    Active: On
    Source:  WireGuard-DNS-Relay-Interface
    Destination:  Remote-DNS-Server
    Service:  domain-udp
    Action: ACCEPT
    [ - ] NAT
    Type: HIDENAT
    Optional if domain controller does not want to respond to requests from the transfer network
    Network object:  internal-interface

    Click Save or Save and Close to save this rule.

    Retrieved from "https://wiki.securepoint.de/index.php?title=UTM/VPN/DNS_Relay_v12.6.1&oldid=109537"