topic Re: DNS resolver support? in General Topics

DNS resolver support?

johnnyringo — Tue, 09 May 2023 16:21:14 GMT

Pretty sure the answer is 'no', but does Checkpoint offer a DNS resolver service on their firewall/gateway products that I'm not aware of? To be clear, I'm just talking a "forwarding" or "cache only" DNS server that can selectively forward certain queries to other internal DNS servers. It does not need to be authoritative or even do recursive lookups.

Palo Alto has offered this feature for at least 5 years called "DNS proxy", which is very useful for hybrid cloud scenarios where private DNS resolution is a requirement. To my knowledge, the are the only vendor with a service like this.

Re: DNS resolver support?

the_rock — Tue, 09 May 2023 16:43:40 GMT

I believe Cisco Umbrella is similar offering. To my knowledge, never heard of something like that on CP.

Andy

Re: DNS resolver support?

the_rock — Tue, 09 May 2023 16:47:41 GMT

Not sure if this might be it, will read up on it after

https://sc1.checkpoint.com/documents/SMB_R80.20/AdminGuides/Locally_Managed/EN/Content/Topics/Configuring-DNS-Server.htm?TocPath=Appliance%20Configuration%7CManaging%20the%20Device%7C_____7#:~:text=By%20default%2C%20the%20Check%20Point,the%20Enable%20DNS%20Proxy%20checkbox.

Re: DNS resolver support?

johnnyringo — Tue, 09 May 2023 18:45:30 GMT

Huh interesting. Seems like it would forward all DNS queries though, which in this specific case I want to avoid (i.e. i only want 'example.internal" to be forwarding to internal DNS servers, with all other queries going to the default DNS server.

Re: DNS resolver support?

the_rock — Tue, 09 May 2023 18:52:00 GMT

Right...oddly enough, I could not find similar process for regular Gaia, so not sure it even exists, but maybe someone else can confirm.

Andy

Re: DNS resolver support?

the_rock — Tue, 09 May 2023 18:54:53 GMT

Quickly checked clish and I see below option, but dont believe this would help in your case either...?

Andy

quantum-firewall> set dns proxy forwarding-domain
DNS Forwarding Domains:
DNS queries in a forwarding domain can be forwarded to specific DNS servers.
A forwarding domain consists of a domain suffix and 3 DNS servers.
DNS queries ending with the domain's suffix will be forwarded to the domain's DNS servers.

quantum-firewall> set dns proxy forwarding-domain

Re: DNS resolver support?

Wolfgang — Tue, 09 May 2023 19:52:19 GMT

@the_rock the mentioned feature is possible with VSX and as I know not available in normal GAiA

Working with Virtual Systems chapter „configuring DNS server for a virtual system“

Re: DNS resolver support?

the_rock — Tue, 09 May 2023 19:57:36 GMT

Thanks for pointing that out @Wolfgang , good to know.

Andy

Re: DNS resolver support?

emmap — Wed, 10 May 2023 01:57:34 GMT

DNS forwarding is only supported on the Spark range. If you need it on Quantum, please raise an RFE.

Re: DNS resolver support?

johnnyringo — Wed, 10 May 2023 02:01:12 GMT

Or I could buy a Palo Alto and actually have the features I want right now.

Just sayin'

Re: DNS resolver support?

the_rock — Wed, 10 May 2023 02:56:55 GMT

As I like to say...I dont disagree with you, meaning, I AGREE with you 😉

Andy

Re: DNS resolver support?

PhoneBoy — Wed, 10 May 2023 16:09:48 GMT

Gaia includes dnsmasq as part of the installation, which I believe can serve this function.
This is from a while ago, but it should still mostly be applicable.
See: https://phoneboy.org/2014/09/02/fun-with-check-point-dynamic-ip-gateways-in-r77-dot-20-with-gaia/

Note this is not formally supported.
If you require formal support, please raise an RFE with your local Check Point office.

Re: DNS resolver support?

Wolfgang — Wed, 10 May 2023 18:40:11 GMT

This solution only works for embedded GAiA gateways. It's too mentioned by @KennyManrique in this older thread https://community.checkpoint.com/t5/SMB-Gateways-Spark/DNS-forwarding-for-internal-domain/m-p/69380#

Every year since the last 5 years I created a feature request for this. Maybe it will be available in the next decade...

Re: DNS resolver support?

PhoneBoy — Wed, 10 May 2023 18:44:06 GMT

I've used it on Gaia (not embedded) gateways and it works.
Granted, this wasn't recent, but I do see that dnsmasq is still present in R81.20 and have no reason to believe it wouldn't work with a similar configuration.

That's not the same as fully supported, of course (which requires an RFE).

Re: DNS resolver support?

Wolfgang — Wed, 10 May 2023 19:03:33 GMT

Available on „real“ GAiA, this sounds really good Dameon. Never checked this out.

Re: DNS resolver support?

the_rock — Wed, 10 May 2023 19:18:03 GMT

I did test this in my R81.20 lab and it did work. But, lets be honest here...if someone did it in production and it broke, TAC would never help them, as its not officially supported and as we all know, RFE can take weeks, months, years...maybe more, who knows.

Re: DNS resolver support?

HeikoAnkenbrand — Wed, 10 May 2023 19:21:04 GMT

Hi @johnnyringo,

DNS server is not supported on a GAIA gateway. RFE will take too long 🙂
But the following SK can help you. Maybe in your case it is possible to solve this via DNS NAT.

How to configure DNS NAT (sk34295)

Re: DNS resolver support?

the_rock — Wed, 10 May 2023 19:22:12 GMT

Had customer who wanted to do this couple of years ago, we had TAC case going for 4 months, went nowhere, so client gave up on it. Not sure if anyone made it work before, but we must have spent at least 20-25 hours on the phone with support trying to make this work and nothing.

Re: DNS resolver support?

N_Desrochers — Tue, 08 Aug 2023 17:37:38 GMT

I use it on VSX in R81.10 and works

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_VSX_AdminGuide/Topics-VSXG/Working-with-Virtual-Systems.htm?Highlight=DNS%20per%20VS