This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Local DNS Behaviour

So I've run into a problem using local DNS resolution with Sophos UTM 9.313.

The network is 1 internal subset ( 192.168.55.0/24 ) and has four external IP addresses. The web server is located at 192.168.55.25. In order to support applications that require websockets, I have used one of the four external IP addresses as a passthrough ( we'll call it xx.xx.xx.xx on port 80 / 443 are routed / NAT / firewalled directly to 192.168.55.25 ) and another external IP ( say yy.yy.yy.yy ) is setup with WAF applications.

Here's the issue: When using local DNS entries, Sophos appears to assign wildcard matching status even when no wildcard is specified. Thus, the setup is seen as:

computer.name.local
Reverse DNS -> Checked
Additional Host names:
domain.name
www(dot)domain.name
sub1.domain.name
sub2.domain.name
sub3.domain.name

All of these domains are hosted on the external IP that points directly to the webserver ( xx.xx.xx.xx ), so in order for them to work internally ( due to the routing issues mentioned elsewhere on these boards ) internal DNS must be configured ( preferred ) or a full NAT setup to allow proper redirection.

The domains all work fine, until you try to access the WAF on the alternate external IP address ( yy.yy.yy.yy ). Then things go bad. For example, I type in sub4.domain.name which is hosted on yy.yy.yy.yy instead of xx.xx.xx.xx, and my browser tells me it cannot resolve the domain. Okay, odd, start troubleshooting. The problem goes away as soon as I remove the non-sub address.

In other words, the host entry now looks like:

computer.name.local
Reverse DNS -> Checked
Additional Host names:
www(dot)domain.name
sub1.domain.name
sub2.domain.name
sub3.domain.name

Now, both xx.xx.xx.xx and yy.yy.yy.yy hosted domains work, but on the internal network I can no longer resolve domain.name. The easiest solution would be to setup domain.name and www(dot)domain.name on the WAF so that both resolve, but the WAF still does not support websockets in 2015 without modifications that do not persist across reboots of the Sophos UTM ( see here regarding feature requests about websockets ). Another solution would of course be to setup an actual dedicated internal DNS server, but that seems pretty heavy handed for what I require ( only a few addresses ).

I guess my question then is, is this the expected behaviour? Is not including a a subdomain in the DNS resolution of Host objects on a Sophos UTM supposed to be the same as specifying a wildcard address?

This thread was automatically locked due to age.

0 BAlfson over 9 years ago

Hi, AK, and welcome to the User BB!

When using local DNS entries, Sophos appears to assign wildcard matching status even when no wildcard is specified

I don't think we're following your explanation, else you'd have gotten an answer by now. Please show us your configuration - click on [Go Advanced] below and attach pics.

Cheers - Bob
PS Should this post be moved to the Webserver Protection (WAF) forum?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 9 years ago

So, you've setup WAF virtual servers on your internal interface? Are your internal clients also using the Web Filtering Proxy for connections to your internally hosted sites? Although you've provided a good deal of information here, the presentation is confusing. As Bob says, screenshots and maybe flow diagrams would be helpful. A bit more clarity on the example host entries would go a long way too. You've obfuscated the entries too much. In several, you use the entry "name" in the TLD part of an FQDN and in another you use "name" in the domain part of an FQDN. You have to use a variable consistently. [:)]

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 armouredking over 9 years ago in reply to Scott_Klassen
PS Should this post be moved to the Webserver Protection (WAF) forum?

This is not a WAF issue, this is a DNS issue. The reason WAF is brought up at all is because that is my preferred choice for routing traffic to the webservers ( particularly due to the UTM's ability for simplistic user form authorization ), but I cannot use the WAF for anything that requires websockets to work ( as noted previously ) which then requires me to port forward directly to an internal server for apps requiring websockets.

So, you've setup WAF virtual servers on your internal interface? Are your internal clients also using the Web Filtering Proxy for connections to your internally hosted sites? Although you've provided a good deal of information here, the presentation is confusing. As Bob says, screenshots and maybe flow diagrams would be helpful. A bit more clarity on the example host entries would go a long way too. You've obfuscated the entries too much. In several, you use the entry "name" in the TLD part of an FQDN and in another you use "name" in the domain part of an FQDN. You have to use a variable consistently. [:)]

The names are used consistently. Specifics on internal networks are "...local". I only included a simplified form to show internally they are addressed differently. Externally, the items are as listed. I did not include the names previously given the NSFW content that can be found there with some of the artwork I have up from various commissions - it is best not to accidentally get someone into trouble at work and this isn't something you could have tested externally.

Here is a simplistic flow diagram - I myself am not an artist:

Things currently follow KISS internally. 192.168.55.1 is the Sophos UTM internal. This is bonded by multiple CAT6 to the Cisco Switch ( SG200-18 model ) 192.168.55.2. From there things go elsewhere. Everything is on the 192.168.55.x/24 layout.

Previously, the webservers were on separate subnets ( 192.168.53.x and 192.168.57.x ) but I have since consolidated them into the same network as I reduce hardware appliances, which began all my problems.

Thus, I encountered the routing problem now that everything was on the same subnet, and took action as required here. I setup solution #1. This works for everything except one case.

This setup does not allow any internal client to connect to the websites hosted by the WAF. For example, read.deoremann.com is hosted by the WAF; you will note it is not listed above in the DNS resolution. Only external clients can connect. What you will receive from an internal client is the following:

> ipconfig /flushdns
> ping read.deoremann.com
Ping request could not find host read.deoremann.com. Please check the name and try again.

Changing the setup to the following:

> ipconfig /flushdns
> ping read.deoremann.com
Pinging read.deoremann.com [184.188.106.179] with 32 bytes...

Allows resolution to work as expected.

Note again that read.deoremann.com. is not included. It appears that including the domain name without a proceeding subdomain works as blocking / wildcard to domains being served by the WAF. IE: because I specified 'deoremann.com' with no subdomain as a DNS entry in the hosts records, 'read.deoremann.com' does not resolve. Changing the order it is listed in has no effect.

There are two resolutions I see from my end without going full NAT ( which I had difficulties setting up ): making the www and @ domains WAF hosted ( which means no websockets ) or proceeding without internal resolution for the @ domain ( since resolving it would appear to require another DNS which I honestly do not need for the simple network I have ).
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

Thanks for the pics - having seen them, your original explanation is clear.

Why not simply create another Host with 'Hostname: read.deor***nn.com' for 184.x.y.179?

Bear in mind that the UTM's bind configuration is not intended to be a full-fledged DNS server. That being said, this doesn't work as I would have expected so if this is a paid license, please have your reseller get Sophos Support involved to confirm whether this is a bug or a feature.

I'm confused by your comment that a Full NAT was complex. If read.deor***nn.com is hosted on an internal server, put a new Additional Address "read" on the Internal interface. Create a Host definition for that IP and give it the hostname read.deor***nn.com. The NAT is
Full NAT : Internal (Network) -> Web Surfing -> Internal [read] (Address) : from Internal [read] (Address) to {IP of internal server}

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 armouredking over 9 years ago in reply to BAlfson

Thanks for the pics - having seen them, your original explanation is clear.

Why not simply create another Host with 'Hostname: read.deor***nn.com' for 184.x.y.179?

So basically a 'dummy' entry? The equivalent to editing hosts files I suppose. Didn't cross my mind that was a possibility. For the moment I have just set about refiguring where websocket services are run.

Bear in mind that the UTM's bind configuration is not intended to be a full-fledged DNS server. That being said, this doesn't work as I would have expected so if this is a paid license, please have your reseller get Sophos Support involved to confirm whether this is a bug or a feature.

It's not. Hence asking here for clarification of the function rather than throwing in a ticket.

I'm confused by your comment that a Full NAT was complex. If read.deor***nn.com is hosted on an internal server, put a new Additional Address "read" on the Internal interface. Create a Host definition for that IP and give it the hostname read.deor***nn.com. The NAT is
Full NAT : Internal (Network) -> Web Surfing -> Internal [read] (Address) : from Internal [read] (Address) to {IP of internal server}

Cheers - Bob

I attempted to setup a full NAT setup as described by the KB article referenced above. I didn't do it for a specific hostname as you suggest ( seems counter to KISS to set it up with a DNAT / FNAT when you can go the DNS route ); when I attempted to set it up I got internal resolution but lost external access ( something about a socket error I think ). Been a few days. The NAT was the alternative solution offered by the KB, so I setup the primary solution instead but it didn't work as I had expected it to do so.
Cancel
Vote Up 0 Vote Down

Cancel

Local DNS Behaviour

Submitted a Tech Support Case lately from the Support Portal?