[9.191-2] DNS blocking

Hello,

after the update to 9.191-2 my DNS doesn't work if i use for the UTM my internal DNS Servers.

I see in the Firewall Log after the Update that the Default DNS Drop Rule blocks every DNS resone from the Domain Controllers to the UTM.

After i make a rule for allow every traffic between the UTM and the Domaincontroller, i don't work.

Only if i use the DNS from the provider assinged the internet access works again. But this is a problem in case of domain join and internal DNS definition.

The biggest Problem is, that the Domain Controllers can not make a DNS request to outside.

If you make a Rule Any, Any, Any DNS will blocked too. [:(]

0 BarryG over 11 years ago

Hi Alex,

Could you please post a few lines from the firewall full log?

A screenshot of the UTM's DNS settings page might help too.

Thanks,
Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Alex76 over 11 years ago

The DNS Settings you find attached.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BarryG over 11 years ago

Hi,

For the first screenshot, it should work if you point your internal systems to use the UTM as their DNS server.

For the 2nd screenshot, you'd need firewall rules to allow the mailserver to make DNS requests to the internet:
from: Mailserver
to: Internet
service: DNS
Allow

However, I recommend you read
https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/32566

and follow the example configurations there.

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Alex76 over 11 years ago

Hi Barry

i think you don't read my post before. Before everything works, so i have the firewall rules. Otherwise this can not work before.

i think there is anything wrong with the IPS, this is the only change in the changelog of this update.

Now it works, but it works only, if i disable my DNS configuration and the UTM get a new pattern update. Otherwise you have no access to the internet, after this update.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 brunomc over 11 years ago

Hi,

Just my two little cents:
I have rather a complex dns setup and all works as it should. So something might gone wrong. Can you check everything and all rules line by line (to make sure none got deactivated or borked during upgrade).

The second pic by the way does not make any sense as it means forward dns requests to the mail server i don't think you're mail server is a dns forwarder is it now ? It is a requestor and should not be in that box of forwarders and in that pic also use other dnsservers assigned by isp is disabled.

from manual : Forwarders are DNS servers that can resolve DNS resolution requests.

regards,
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BarryG over 11 years ago in reply to BarryG

Hi Alex,

Could you please post a few lines from the firewall full log?

Also, please attach screenshots of the firewall rules, and explain how your DNS is setup for your networks... it's not very clear to me.

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kofi over 11 years ago in reply to Alex76

Hi Alex,

Hi Barry
i think there is anything wrong with the IPS, this is the only change in the changelog of this update.

In the up2date to 9.191 weren't any changes regarding ips. The only changes were about an issue with http proxy and a problem with the reporters, which includes the ips reporter.

Now it works, but it works only, if i disable my DNS configuration and the UTM get a new pattern update. Otherwise you have no access to the internet, after this update.

For ips the last pattern we released was end of november. But yes, with an old pattern of ips you'll have a lot of problems. As far as I know at least 9.105 has to be installed when using 9.2.

Best,
Kofi
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 simby over 11 years ago

Kofi, why 1 month old patterent? Snort update 8x month / 2x week.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel