Force DNS requests to an internal server

Question

Hello I want to force all DNS requests to an external server to the first step has been to change the DNS server in the DNS section and DHCP, and ok, it works. 
 Now if a client has a different DNS server configured they will bypass my DNS server, how can I avoid this? 
 
 With this approach https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/96094/how-to-force-dhcp-clients-to-use-specific-dns-adress-like-8-8-8-8 
 I understand that I can block other DNS servers, but what I want is not to block them but redirect them to my local DNS server, I have been trying with DNAT rules but I can get it work, still DNS request go outside without being force to go through my DNS server. 
 How can I implement the behaviour I want? 
 I have been readling a little bit more a looks like Sophos is not able to capture all traffic in a port to redirect it because you can not have source address ANY. This is a shame, this feature is avaiable in any other comercial firewall, even in free firewalls like ipfire, opensense, pfsense, etc. you can do that. 
 This is another basic thing that can't be done in Sophos XG I don't understand the roadmap of this product and I don't understand how this can be called a enterprise grade firewall if can't work with basic firewall rules, in Sophos UTM is possible, as usual it's a more powerful firewall. 
 More info here 
 community.sophos.com/.../how-to-replicate-utm-rule-to-redirect-dns-ntp-to-internal-server

Casual_User · Accepted Answer

There is no way to force all DNS traffic outgoing from the LAN to every IP of the WAN on port 53 to the XG. You can do this on UTM, but this feature has not yet been added to the XG. 
 We have described the work around above. You can supply the internal DNS server to your LAN clients through the DHCP configuration. Then block all LAN to WAN traffic on port 53. I have done this and it works flawlessly. On my network, you must use the XG as the DNS server or you cannot access the WAN.

Billybob · Answer

I have tried it and it works in EAP1. Basically, I wanted to redirect all DNS traffic to my own XG instead of a client deciding where to go. You have to work under the NAT tab and make sure that the rule is above everything else and not tied to any firewall rule. The NAT tab is a mess but that is not the discussion here. 
 
 Redirect to Internal DNS:

Redirect to XG itself

Regards 
 Bill 
 EDIT: If you are redirecting to an external server, you probably will have to masquerade the translated source but I haven't tested that functionality. Also if you want to specify certain LAN segment or a certain device, you can do that instead of ANY as your source