Block all but allow DNS port 53
-
Hello, Could any one confirm my setup or is there something I've missed?
Infrastructure
LAN1
LAN2
LAN3
LAN4
Server1 (DNS port 53 at LAN1)
PfSense (2.2.6 i386)
Client1 (LAN2)This is what I want:
Client1 (DNS request) –->LAN2 SWITCH--> PfSense --->LAN1 SWITCH----> Server1 (DNS port 53)Server1 (DNS answer) --->LAN1 SWITCH---->PfSense --->LAN2 SWITCH---->Client1 (DNS answer)
Block ALL trafik from LAN2 to LAN3 and LAN4.
I want to block all trafik from LAN2 to LAN1 but not DNS request to server1 at LAN1. Clients at LAN2 should get the DNS from Server1 and then connect to desired host at WAN.See attached pictures (FW_rules.jpg) for rule setup.
How I get it to work:
Client1 does not get DNS answer. But If I allow all traffic from LAN2 to LAN1 then it works.How should I proceed?
-
Is Client1 configured to use Server1 LAN1_IP as its DNS server?
-
Yes, I can confirm that DNS is Server1 LAN1_IP. DNS is setup in LAN2 DHCP to be Server1 LAN1_IP.
-
Then it should be working.
Can you confirm that that's actually the DNS server client1 is trying to use?
Use dig/drill on Client1 to send DNS queries directly to the server.
-
Ok, thank you for your help! Then I know that the firewall setup is correct. Will troubleshoot at the client.
-
You mention server lan1_ip ?? Does this server have interfaces in more than just lan?? Its quite possible you have some sort of asynchronous routing issue if your using multihomed hosts??
But yeah those rules are correct.
