Is it possible to override DNS Proxy or create exlusions?

Thomas_Eichelbu — Mon, 20 Sep 2021 13:15:26 GMT

Hello together ...

as a seperate post to this thread:
https://community.checkpoint.com/t5/Security-Gateways/ISP-redundancy-and-DNS-records-for-Web-Servers-in-DMZ/m-p/110929

Is it possible to exclude IP ranges or VPN or perhapes special suffixes from DNS proxy ???
Since all DNS requests passing an external interface are always catched by the gateway ... its often bad to get only the external DNS responses when the internal DNS addresses are required ... (Split DNS behavior)

since sk23630 describes a script, perhaps there are commands for exclusions?

# Start of dbedit script
#####################
# Activate the DNS feature
modify network_objects corporate-gw firewall_setting::misp_dns_active true
#####################
# Add the first entry (www.example.com, 192.168.1.80, 172.16.2.80)
create misp_dns_entry tmp_name
modify owned tmp_name misp_host_name www.example.com
addelement owned tmp_name misp_dns_addresses 192.168.1.80
addelement owned tmp_name misp_dns_addresses 172.16.2.80
add_owned_remove_name network_objects corporate-gw firewall_setting:misp_dns_entries owned:tmp_name
delete owned tmp_name
#####################
# Add the second entry (ftp.example.com, 192.168.1.21, 172.16.2.21)
create misp_dns_entry tmp_name
modify owned tmp_name misp_host_name ftp.example.com
addelement owned tmp_name misp_dns_addresses 192.168.1.21
addelement owned tmp_name misp_dns_addresses 172.16.2.21
add_owned_remove_name network_objects corporate-gw firewall_setting:misp_dns_entries owned:tmp_name
delete owned tmp_name
#####################
# Update the object
update network_objects corporate-gw
quit
#####################
# end of dbedit script
#####################

maybe someone has an idea?

best regards
Thomas

Re: Is it possible to override DNS Proxy or create exlusions?

PhoneBoy — Wed, 22 Sep 2021 15:41:57 GMT

DNS Proxy follows the NAT rulebase.
So...if you want to create exclusions, you would configure them as NAT rules.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34295

topic Re: Is it possible to override DNS Proxy or create exlusions? in SASE and Remote Access

Is it possible to override DNS Proxy or create exlusions?

Re: Is it possible to override DNS Proxy or create exlusions?