Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 50714 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to force certain clients to use certain DNS servers?

Jose Aponte

Hello everyone, I hope someone can help me. I am new to Sophos UTM 9.4 and I wonder if it is possible to force certain clients based in their static IP addresses to use certain DNS server?

For instance:

All network (19.20.21.1 to 19.20.21.254) uses Google DNS server

but I would like to force 19.20.21.10 and 19.20.21.21 clients to use opendns server.

Is this possible? What needs to be configured?

Thanks in advance.



This thread was automatically locked due to age.
Parents
  • 0

    hm... not a case for the firewall i think...

    set up a dhcp server for your network (19.20.21.0.. hm not a private adress hope you own these)

    the dhcp server gives google dns servers out.

    the 2 clients set up with fixed config using opendns-server.

    on the firewall you need rules then which allows dns-traffic to the google dns and opendns-server.

    there are many ways you can get your needs running... its just one quick way ;-)

  • 0 in reply to zaphod

    Thank you zaphod for the reply.

    Sorry, I just used any IP address to give the example.

    The situation is that I do not want to set the fixed DNS server directly in the clients.

    I come from running Asuswrt Merlin in a very old Asus router and here I can set this up very easily. But now I was trying to improve my home network security by using Sophos UTM. So I wonder if there was also an easy way to do this in the Sophos UTM.

    They call it DNS-based filtering.

    I have the central router dhcp server configured to 8.8.8.8 dns for the whole network.

    But then, I have a few MAC addresses, to which the router leases static IPs, forced to use the OpnDNS server.

    This works very well.

    Regards and thank you again.

     

  • 0 in reply to Jose Aponte

    Hi, Jose, and welcome to the UTM Community!

    Good question - this is possible, and can be done easily.

    I would configure 'DNS' in the UTM and your network according to DNS best practice, but have only the subnets in 'Allowed Networks' that should use Google.  Then, use a DNAT or Full NAT that forwards all port 53 traffic to OpenDNS for the DNS requests coming from the IPs statically assigned.

    You will learn that WebAdmin works mostly with CIDR notation, so this solution is easier to implement if your DHCP server has a simple CIDR block for the dynamically assigned IPs.  Note also that the UTM DHCP server does not use "reservations" as does Microsoft's - the dynamic range cannot overlap the range of statically-assigned addresses.

    Cheers - Bob

Reply
  • 0 in reply to Jose Aponte

    Hi, Jose, and welcome to the UTM Community!

    Good question - this is possible, and can be done easily.

    I would configure 'DNS' in the UTM and your network according to DNS best practice, but have only the subnets in 'Allowed Networks' that should use Google.  Then, use a DNAT or Full NAT that forwards all port 53 traffic to OpenDNS for the DNS requests coming from the IPs statically assigned.

    You will learn that WebAdmin works mostly with CIDR notation, so this solution is easier to implement if your DHCP server has a simple CIDR block for the dynamically assigned IPs.  Note also that the UTM DHCP server does not use "reservations" as does Microsoft's - the dynamic range cannot overlap the range of statically-assigned addresses.

    Cheers - Bob

Children
  • 0 in reply to BAlfson

    Thank you Bob for your reply.

    I will give it a try. I already have the DNS configured according to the best practice as you suggest. However, I have only one subnet in my setup. I have all the eth ports and wlan working in bridge mode with a single subnet. I guess the DNAT or Full NAT rule should do the trick anyway, do you think otherwise?

    Anyway, I will give it a try and report back.

    Regards...