I'm trying to configure an ASA as transparent DNS proxy. This means that the ASA has to redirect all the DNS queries that violets a certain policy to a DNS server. For example in this way it is possible to avoid that a client uses a self-configured DNS server redirecting his traffic to a trusted DNS server.
A transparent proxy is a device that operating on the network layer is able to redirect the traffic to a proxy server without any configuration on the client side. The following configuration will address the problem of how to configure the ASA (version 8.4) as DNS transparent proxy. With very little effort it is possible to configure the ASA as HTTP transparent proxy.
Before configure a transparent proxy ensure that your clients know and understand the security policy.
This kind of problem (and many others) would be solved with policy based route using the "set ip next hop" IOS's command and some form of "transparency" on the local proxy server.
The ASA does not support policy based routing (PBR) but it's still possible to achieve some degree of PBR (at least to solve the question) using NAT and the egress interface selection process. More info here
Let's assume this schema:
With the following network addresses:
- inside 192.168.1.0/24
- dmz 10.0.0.0/24
- outside 188.8.131.52/30
Suppose there is a DNS server on the dmz with 10.0.0.2 as IP address.
Assuming the network objects and the service objects have been properly configured the following NAT statement (known as Policy NAT) will do the trick:
nat (inside,dmz) source static obj-inside obj-inside destination static obj-any obj-DNS-Serv service obj-DNS obj-DNS
For a reference on how to configure the objects refer to this:
object network obj-inside
subnet 192.168.1.0 255.255.255.0
object network obj-DNS-Serv
object network obj-any
subnet 0.0.0.0 0.0.0.0
object service obj-DNS
service udp destination eq domain
service tcp destination eq domain
Pay attention that you have to properly define network objects according to your envirorment.
The easiest way to achieve DNS query restrictions is to implement an external interface ACL that blocks port 53 outbound.
access-list 110 deny udp any any eq 53
Short, sweet, and to the point.
With regard to your OP, “Redirect all DNS request with ASA5505 to one specific DNS server” at ServerFault suggests that policy based routing capabilities don't exist in ASAs but recommends policy NAT, instead. I'm not familiar enough with that function to give examples, though.