Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 22 replies
  • Answers 5 answers
  • Subscribers 5 subscribers
  • Views 29116 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN - Block-Outside-DNS?

TitanRob16

Hi all,

 

I just have a quick question regarding the Sophos SSL VPN within UTM 9 - does it automatically block outside DNS from being used? 

The reason I ask is because I'm setting up our Sophos VPN so we can retire our IPCop server, and on that we had to configure it to push the block-outside-dns setting, so it would then automatically obtain the DNS addresses from the VPN connection, rather than the local router. Is this something I would also need to configure with the Sophos UTM? 

 

Regards,

 

Rob



This thread was automatically locked due to age.
Parents
  • 0

    you can configure ssl-vpn to obtain dns-server adressses from vpn-connection.

    Remote-Access / Advanced there you find the options that can be configured to be pushed by dhcp to the ssl-vpn-client.

  • 0 in reply to zaphod

    Thanks, although when I go here all I can see are the Cryptographic settings, compression settings and the debug settings. None of these give an option to block outside DNS, which makes me wonder if it needs to be done with the Sophos or not. 

  • 0 in reply to BAlfson

    Full tunnel, I believe. It's not a setting we're particularly wanting - I'm just trying to understand how it handles the DNS requests and I need to ensure we won't run into the same issue as we did with the IPCop server where it would send the VPN DNS traffic to the local router, therefore not being able to resolve anything. 

  • 0 in reply to TitanRob16

    Rob, please confirm that this is SSL VPN Remote Access and not site-to-site.

    Earlier, you said, "The only way around this was to add the option to block outside DNS, and so only the client was forced to send the DNS request through the VPN."  How did you block the traffic?

    Cheers - Bob

  • 0 in reply to BAlfson

    Yes, this is SSL VPN Remote Access. 

    With IPCop, we had to add "block-outside-DNS" to the configuration file. Once done, the VPN client would then only resolve DNS names through the VPN tunnel, rather than through the local router. Hopefully that makes sense. 

    As I said, it's not particularly an option we want to enable on the Sophos - I'm just looking to understand how it handles the traffic. 

     

  • 0 in reply to TitanRob16

    You could create a DNAT rule like this:

    Traffic from: SSL remote access
    Using service: DNS
    Going to: Internet IPv4

    DNAT to: internal (address) (or use the 10.242.2.1 as destination in case you use the default IP-ranges)

  • 0 in reply to apijnappels

    Apijnappels, I wouldn't do it like that.  I would just use 'Remote Access >> Advanced' to set DNS to the IP of the internal DNS server and, secondarily, to the IP of "Internal (Network)" as zaphod showed him above.

    Cheers - Bob

  • 0 in reply to BAlfson

    @Balfson, I would do the same, but it is not the same as blocking access to external DNS server. A user can override the DHCP assigned DNS server. A DNAT rule will prevent the possibility to ever reach an external DNS-server.

  • 0 in reply to apijnappels

    I admit that it's not clear to me whether he's talking about his old router getting DNS for internal users from an outside DNS server or what.

    The user's DNS request to a server in the remote LAN would stay in the remote LAN, immune to the DNAT in the UTM.  Since the tunnel is from the PC to the UTM, and not between the router and the UTM, we have no control over the router.  The router has no idea the UTM exists.

    If the current router in the remote office can't do an IPsec tunnel with the UTM, then maybe he needs a small SG with Network Protection. [:)]

    Cheers - Bob

  • 0 in reply to BAlfson

    I think he routes all traffic over the VPN since before he needed another product specifically for blocking external DNS requests. This other product can also not handle traffic that doesn't travel over the VPN and goes out directly to the router at the client side of the VPN tunnel. But these are all assumptions.....

  • 0 in reply to apijnappels

    Hi Balfson & Apijnappels,

    When you have a DNS configured in the SSL VPN settings, doesn't this enforce all DNS requests to be made via the UTM/XG first? This is to establish whether FQDNs are to go over the tunnel or to the internet (in split tunnel mode)?

    It would make sense but that's just conjecture.

    Emile

  • 0 in reply to Emile Belcourt

    Agreed, Emile, but, as apijnappels noted, the user could change the DNS settings on his PC after establishing the tunnel.

    Cheers - Bob

Reply Children