DNS Capture with an Exception

jwarmuth

Greetings,
I am fairly new to PF Sense and I am running it in a school environment. I am using DNS resolver and a port forward intercept to force all users regardless of setting to use my DNS and we are filtering at the DNS level. I have the following rule:

Interface: LAN
Protocol: TCP/UDP
Destination: Network 192.168.1.1/24 INVERTED MATCH
Destination Port: DNS
Redirect Target 127.0.0.1
Redirect Port: DNS
Nat Reflection: Disabled

So this works without an issue. No matter what the user sets their DNS to I intercept it and pass it through the filter. I have a few static addressed clients that I do not want filtered. I want to be able to bypass the above rule and send them on to the google dns at 8.8.8.8. No matter what I try I can get this action to work properly. If someone could please give me a little guidance on letting statically mapped and defined local machines ie 192.168.1.250 to bypass the above rule and proceed without DNS being intercepted. Thanks.

Napsterbater

Create an Alias containing the IPs/Networks you want excluded.

Goto the Click "Advanced" next to source. For Source Check Invert match, select Single host or Alias, type/set the Alias name.

Save the rule.

jwarmuth

Thanks, I am so use to writing an all inclusive rule and then writing exception rules above that rule to exclude things… I never though of the easy solution like that.

jwarmuth

I made the changes you mentioned but I still can not get it to work. Right now it is bypassing all clients instead of just the alias. I can basically get it to filter all or bypass all. Perhaps I miss-understood something. Here is my rule as it sits now:
Interface: LAN
Protocol: TCP/UDP
Source: INVERT MATCH - Alias - bypassfilter
Source Port: DNS

Destination: INVERT MATCH - Network - 192.168.1.1/24
Destination Port: DNS
Redirect Target: 127.0.0.1
Redirect Port: DNS
Nat Reflection: Use System Default

viragomann

The source port has to be "any", only dest port is "DNS".

Napsterbater

@viragomann:

The source port has to be "any", only dest port is "DNS".

This. Applications source ports are usually random ports. And are in the case of DNS.

Sorry I didn't mention that.