Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 13 replies
  • Subscribers 28 subscribers
  • Views 9301 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Prevent DNS Request Override

james3820

Hello!

I'm using a DNS content filtering service (Clean Browsing) and am trying to specify different DNS servers for different zones so that different DNS filtering policies are applied by setting the DNS servers in each specific zone's DHCP settings and then allowing only those DNS servers through via a firewall rule.  Clean Browsing allows you to create profiles with different DNS filter categories and generates new DNS server IPs for each specific profile.  So clients pointing to Clean Browsing's DNS Server IP A from my WAN address get a different DNS filter policy than those pointed at DNS IP B

 

I'm noticing that regardless of the DNS server the client is set to use, the DNS servers set in the DNS tab of the network settings are the one that ends up being used (XG intercepting the DNS Traffic?).  To test this, I set a client to specifically use OpenDNS via DHCP settings, verified the setting was applied via ipconfig /all, and tested against a known FQDN OpenDNS blocks.  To my surprise, I received the blocked page of the other DNS content filtering provider that was specified in the DNS tab of the XG.  If I change the server in that tab to OpenDNS, I do receive the OpenDNS blocked page.  Changing whether "DNS" is enabled in the zone configuration page does not seem to make a difference.  

 

I need a way specify DNS servers for each network zone so that different DNS filtering policies are applied by the DNS content filter.  Is this possible?  

 

Thanks for any ideas/help you can provide! 



This thread was automatically locked due to age.
  • +1 in reply to james3820

    Do you perhaps have Web Pharming Protection turned on?  Web > General Settings >  Pharming Protection

     

    Pharming Protection is used in transparent mode to ignore the client's destination and look up DNS on its own.  It is specifically used to mitigate attacks that poison the hosts files.  For web traffic that goes through the proxy only, it will force it to use the XG's DNS.

    You can turn it off and then apply a web policy again (you should also turn on HTTP malware scanning which it sounds like you have off).

  • 0 in reply to Michael Dunn

    This was it.  Didn't even think about that option, but it makes sense.   Thanks! 

    Any chance Pharming protection could be set per web filtering policy or something similar in the future?  

  • 0 in reply to james3820

    james3820 said:

    Any chance Pharming protection could be set per web filtering policy or something similar in the future?  

     
    Not in the plans and unlikely, though you could always submit/vote for it at https://ideas.sophos.com/
     
    For any configuration that we put into policy we need to consider what happens if "Allow All" or "None" are selected in the firewall rule, which don't have a "policy" that you can edit.  For example we recently moved SafeSearch into policy, which means that anyone choosing Allow All must always have SafeSearch off.  This is balanced against customers' need to have different settings for different traffic.