DNS setting on ISP facing interface

[Gaurav_Pandya]

We have two ISPs connected to our Check Point firewall (GAIA). One of the ISP-facing interfaces receives its configuration via DHCP, and because of this, DNS servers from the ISP are automatically applied to the firewall.
We want the firewall to always use our internal DNS servers. Although we have manually configured static DNS entries on the firewall, it eventually overwrites them and reverts to the DNS servers received from the ISP via DHCP.
We understand that switching this interface to a static IP would prevent the ISP from pushing DNS settings, but static assignment is not an option in our environment.
How can we prevent the firewall from accepting DNS settings delivered via DHCP—while still keeping the interface on DHCP?

[simonemantovani]

Hello

I never had this need in the past, but I take a look in my lab, there is a possible workaround (I haven't find any documentation on Check Point supportcenter).

You could try to edit /etc/dhclient.conf file, appliyng this changes:

1. you shoudl have at the beginning of the file a line that begins with "request"; remove "domain-name-servers"
2. within the configuration of the interface defined in the dhclient.conf file, add a line like this: prepend domain-name-servers 1.2.3.4 (replace 1.2.3.4 with the IP of your DNS server). if you perform a release/renew (dhclient -r <wan interface with DHCP>) you should see that content of /etc/resolv.conf is changed, and configured with the DNS server desidered.

I'm not sure that the dhclient.conf file is preserved after an upgrade (I haven't tested it).

I repeat, it's a workaround, if there's someone from CP that could provide better and official solution.

For DHCLIENT.CONF I followed the Linux Man Page: https://linux.die.net/man/5/dhclient.conf

[_Val_]

Appliance model, software version in use?

[Gaurav_Pandya]

Hi Val,

Appliance mode - 5200

Version - R81.20

[_Val_]

Thanks, @Gaurav_Pandya 

According to sk107174, this should not happen, as the locally defined DNS servers can have higher priority than those received via DHCP. Please verify you set the highest possible priority for your local DNS servers in the system before trying any unofficial workaround.

[simonemantovani]

Interesting SK, I checked in my labs, on an open server VM R81.20, with DNS configured and the interface eth0 configured with DHCP, and the gateway uses the DNS received from the DHCP.

[Expert@CP-LAB-fw:0]# cat /etc/resolv.conf
; generated by /sbin/dhclient-script
search fritz.box
nameserver 192.168.1.254
[Expert@CP-LAB-fw:0]# nslookup
> www.google.it
Server: 192.168.1.254
Address: 192.168.1.254#53

Non-authoritative answer:
Name: www.google.it
Address: 142.251.140.99
>

CP-LAB-fw> show configuration dns
set dns mode default
set dns suffix fritz.box
set dns primary 8.8.8.8

CP-LAB-fw> show configuration dhcp-client
add dhcp client interface eth0
set dhcp client interface eth0 timeout 60
set dhcp client interface eth0 retry 300
set dhcp client interface eth0 reboot 10

[Gaurav_Pandya]

Hi Val,

I have set primary DNS server, still it changes with ISP provided DNS.

set dns primary <DNS IP>