I am trying to get the DNS Proxy feature working in an SSG5 (Side B). The other side of the VPN is an SSG140 (Side A). The DNS server is on Side A.
foo.com should send DNS queries to 192.168.1.2 (Side A).
Everything else (*) should send queries to 8.8.8.8
-When a host PC on Side B queries 192.168.1.2 directly for foo.com , it resolves.
-If the host queries the SSG5 for *, it resolves.
-If the host tries to query the SSG5 for foo.com, it fails to resolve.
It's hard to tell without seeing a diagram, but I suspect what is happening is that Side B is using the interface address of the tunnel (or the borrowed address of the underlying external interface) as the source address of the DNS request (e.g.: from the "proxy" on Side B to 192.168.1.2) and sending this down the tunnel.
When Side B sees this, it responds to the DNS request, but sends it out via it's "Untrust" rather than tunnel interface (since the tunnel most likely has no route back towards the external interface address of Side B), and it is then dropped by Side B because it enters on the wrong zone.
It's been a LONG time since I've used ScreenOS, but there are a couple of ways you might be able to fix this:
If such an option exists, update the source address/interface of the DNS proxy so that it uses a LAN-side interface (e.g.: a network on Side B that is routable over the VPN tunnel from Side A). This seems counter-intuitive at first, but you're really after the source address, rather than the "direction" the interface is facing.
Assign a /30 to your tunnel interface on both sides and make sure that your DNS server can reach it - this way when Side B initiates it's DNS request, it will use the new routable tunnel interface address, instead of the borrowed address from the underlying interface
[Warning: Filthy Hack] Assign an unused address from the "LAN" side of Side B to the tunnel interface on Side B - this will achieve the same result as 2., but save you have to make any routing changes.
