notempty
- Terms corrected: Instead of Domain Forwarding, the term DNS Forwarding is used.
- Special case configuration: Safe Search with external DHCP server (02.2023)
Introduction
Name resolution is the procedure that allows names of computers or services to be resolved into an address (IP) (e.g.: support.securepoint.de in 85.209.185.22). The UTM can forward a name resolution to another name server or find a specific name for an IP address (reverse lookup).
Additionally there is the function DNS forwarding, which allows to forward all DNS requests to a specific name server.
The network tools article provides an overview of the data that is managed in a name server.
DNS Forwarding
A DNS forwarding is used to forward all DNS requests made to the firewall's name server to another IP.
Add DNS Forwarding
Menu Tab DNS Forwarding Button
| Caption | Value | Description |  |
|---|---|---|---|
| IP address | 192.168.175.2 | The IP address of a DNS server to which the DNS requests should be forwarded. | |
| The entry is saved with this button | |||
The changes in DNS forwarding must also be saved with the button.
Domain forwarding through a VPN tunnel
Sometimes it is necessary to forward internal domain requests to a remote name server located in a VPN.
It should be noted here that, by default, all direct requests addressed to external name servers are sent from the firewall with the external IP. However, a public IP is not routed into a VPN tunnel.
Set the name server of the firewall
| Caption | Value | Description |  |
|---|---|---|---|
| Check name server before local cache: | Yes | Should be enabled | |
| Primary name server: | 127.0.0.1 | The IP of the UTM itself (localhost=127.0.0.1) | |
| Secondary name server: | Should remain empty or designate another DNS in the VPN | ||
| The entry is saved with this button | |||
Create relay
Menü Button
| Caption | Value | Description |  |
|---|---|---|---|
| Zone name: | relay.test.local | The zone name of the desired domain | |
| Type: | Select this type | ||
| IP address | 192.168.8.5 | Click on and in the IP address field the address of the remote name server is entered
| |
| The entry is saved with this button | |||
The changes in the zone must also be saved by clicking the button.
Create network object
From the Tab Network Objects navigation bar, the network object is created under . A network object must be created for the IPSec network.
| Caption | Value | Description |  |
|---|---|---|---|
| Name: | IPSec network | A name for the network object | |
| Type: | Select this type | ||
| Address: | 192.168.8.0/24 | The IP address corresponds to that of the IPSec network | |
| Zone: | This zone must be selected | ||
| The entry is saved with this button | |||
Create rule
In the last step, a firewall rule with a Hide NAT must be created. This causes the DNS forwarding to also go into the tunnel, and not directly into the Internet. From the navigation bar, the application is selected and a rule can be added under .
| Caption | Value |  |
|---|---|---|
| Aktive: | On | |
| Source: |  external-interface
| |
| Destination: |  IPSec-Netzwerk
| |
| Service: |  domain-udp
| |
[-] NAT
| ||
| Type: | ||
| Network object: | internal-interface
| |
| Service: | The Service parameter is not used here and is disabled | |
The entry can be saved by clicking the button.
The port filter must be updated via the button.
With this rule, all domain UDP requests made through the firewall to the remote name server are now nated over the IP of the internal interface and can thus be routed into the IPSec tunnel.
Safe Search with external DHCP server
If an external DHCP server is used, the active web filter Safe Search often does not work for search engines, especially Google, when searching for images.
In order for this web filter to take effect there as well, the following forward zones must be set up for all ccTLDs (see https://www.google.com/supported_domains : www.google.de, www.google.ch, ...). From the navigation bar, use to add a forward zone:| Caption | Value |  |
|---|---|---|
| Zone name: | www.google.com | |
| Name server hostname: | localhost | |
| Name server IP address: | <leave blank> | |
| In the Name server window, click in the www.google.de zone. In the Edit Zone window click . | ||
| Name: | www.google.com | |
| Type: | A | |
| Value: | 216.239.38.120 | |
| and click again on . | ||
| Name: | www.google.com | |
| Type: | AAAA | |
| Value: | 2001:4860:4802:32::78 | |