topic DNS reply filtering in Network Security

DNS reply filtering

arunas.usonis — Tue, 12 Mar 2019 02:21:55 GMT

Hi,

Am trying to make DNS filtering work as URL filtering cannot permit https traffic.

Config is as per below. The thing is that it blocks every url at the moment instead of just test - gmail.com as per regex

It looks simple on the paper but cannot make it work (

regex test "gmail\.com"

access-list http-user-vlan414-acl extended permit object-group http-inspect-ports 10.4.14.0 255.255.255.0 any

class-map type regex match-any DomainBlockList
description blocked domains
match regex test
!

class-map http-user-vlan414-class

match access-list http-user-vlan414-acl

!
policy-map type inspect dns vlan414-policy
parameters
message-length maximum 512
match domain-name regex class DomainBlockList
drop-connection log
!
policy-map http-main-policy-vlan414
class http-user-vlan414-class
inspect dns vlan414-policy

service-policy http-main-policy-vlan414 interface vlan414

DNS reply filtering

arunas.usonis — Tue, 06 Aug 2013 09:33:32 GMT

DNS server sits on the other side of the firewall:

client -> firewall -> DNS server

DNS reply filtering

arunas.usonis — Tue, 06 Aug 2013 11:18:48 GMT

if to rework it into :

policy-map http-main-policy-vlan414
class inspection_default - have replaced with default class, then it starts somehow to work, still not perfect
inspect dns vlan414-policy

so am not sure why it doesn't like the class with ACL , maybe somehow related to inspect dns that you have under default..

DNS reply filtering

arunas.usonis — Tue, 06 Aug 2013 17:07:13 GMT

have sorted it myself, seems documentation is misleading a bit

DNS reply filtering

Julio Carvajal — Tue, 06 Aug 2013 21:00:29 GMT

Hello Arunas,

I was about to ask for some outputs

Glad to know you have it up and running, can you share the solution and mark the question as answered so future users can learn from your experience.

Check my blog at http:laguiadelnetworking.com for further information.

Cheers,

Julio Carvajal Segura

DNS reply filtering

arunas.usonis — Wed, 07 Aug 2013 08:58:10 GMT

Working example:

regex domainlist "example\.com"

class-map type regex match-any vlan414-url-whitelist

description allowed domains

match regex domainlist

policy-map type inspect dns vlan414-policy

parameters

message-length maximum 512

match not domain-name regex class vlan414-url-whitelist

drop-connection log

policy-map http-main-policy-vlan414

class inspection_default

inspect dns vlan414-policy

service-policy http-main-policy-vlan414 interface vlan414

DNS reply filtering

arunas.usonis — Wed, 07 Aug 2013 12:30:04 GMT

Though what I cannot make work - is to use ACL to define which machines are allowed to open url ?

Have tried following :

class-map http-user-vlan414-class

match any - have played with any and ACL, still no luck

policy-map http-main-policy-vlan414

class http-user-vlan414-class -> so here basically substituting class inspection_default with http-user-vlan414-class

inspect dns vlan414-policy

So if am applying differetn class under policy-map my traffic stops immediately

Any help welcome)

DNS reply filtering

Julio Carvajal — Wed, 07 Aug 2013 16:33:09 GMT

Hello Arunas,

So If u set:

class-map http-user-vlan414-class

match any -

policy-map http-main-policy-vlan414

class http-user-vlan414-class

inspect dns vlan414-policy

Okey but have you applied to a service-policy?

What do you mean traffic drops?

Check my blog at http:laguiadelnetworking.com for further information.

Cheers,

Julio Carvajal Segura