topic DNS Query going through implied rules in General Topics

DNS Query going through implied rules

Ihenock1011 — Sat, 26 Oct 2024 09:03:47 GMT

Hi All,

Currently, we have a Checkpoint R81.10 Take 169 firewall. I'm observing a DNS query requests being sent to DNS servers via implied rules. Even the 'Accept Domain Name UDP Queries' option is unchecked DNS requests are still going through implied rules.

Can anyone guide or help us why such behavior is observed ??

Regards,

Re: DNS Query going through implied rules

Chris_Atkinson — Sat, 26 Oct 2024 12:17:36 GMT

What is the source of the request?

Was the policy installed after the setting was unchecked?

Re: DNS Query going through implied rules

the_rock — Sat, 26 Oct 2024 12:36:12 GMT

I see the point Chris is making. If you can confirm that, would help us.

Andy

Re: DNS Query going through implied rules

Ihenock1011 — Sun, 27 Oct 2024 03:09:22 GMT

The source is the CP gateway itself for url and IPS update. From the begning the setting was unchecked.

Re: DNS Query going through implied rules

Chris_Atkinson — Sun, 27 Oct 2024 05:58:42 GMT

There is a separate implied rule that covers outbound traffic from the gateway itself.

Re: DNS Query going through implied rules

Ihenock1011 — Mon, 28 Oct 2024 12:01:13 GMT

Thanks Chris for your reply. So in that case is there a means of disabling/blocking only DNS requests originating from the gateway? What if I want to allow only explicitly permitted DNS servers?

Re: DNS Query going through implied rules

PhoneBoy — Mon, 28 Oct 2024 13:09:02 GMT

Via explicit Access Policy rules, which will apply as long as the relevant Implied Rules are disabled or set to “Before Last.”