3

I'm trying to configure an ASA as transparent DNS proxy. This means that the ASA has to redirect all the DNS queries that violets a certain policy to a DNS server. For example in this way it is possible to avoid that a client uses a self-configured DNS server redirecting his traffic to a trusted DNS server.

1

2 Answers 2

3

A transparent proxy is a device that operating on the network layer is able to redirect the traffic to a proxy server without any configuration on the client side. The following configuration will address the problem of how to configure the ASA (version 8.4) as DNS transparent proxy. With very little effort it is possible to configure the ASA as HTTP transparent proxy.

Before configure a transparent proxy ensure that your clients know and understand the security policy.

This kind of problem (and many others) would be solved with policy based route using the "set ip next hop" IOS's command and some form of "transparency" on the local proxy server.

The ASA does not support policy based routing (PBR) but it's still possible to achieve some degree of PBR (at least to solve the question) using NAT and the egress interface selection process. More info here

Let's assume this schema:

(inside)----ASA----(outside)
             |
             |
           (dmz)

With the following network addresses:

  • inside 192.168.1.0/24
  • dmz 10.0.0.0/24
  • outside 1.1.1.0/30

Suppose there is a DNS server on the dmz with 10.0.0.2 as IP address.

Assuming the network objects and the service objects have been properly configured the following NAT statement (known as Policy NAT) will do the trick:

nat (inside,dmz) source static obj-inside obj-inside destination static obj-any obj-DNS-Serv service obj-DNS obj-DNS

For a reference on how to configure the objects refer to this:

object network obj-inside
 subnet 192.168.1.0 255.255.255.0
object network obj-DNS-Serv
 host 10.0.0.2
object network obj-any
 subnet 0.0.0.0 0.0.0.0
object service obj-DNS
 service udp destination eq domain
 service tcp destination eq domain

Pay attention that you have to properly define network objects according to your envirorment.

2

The easiest way to achieve DNS query restrictions is to implement an external interface ACL that blocks port 53 outbound.

access-list 110 deny udp any any eq 53

Short, sweet, and to the point.

With regard to your OP, “Redirect all DNS request with ASA5505 to one specific DNS server” at ServerFault suggests that policy based routing capabilities don't exist in ASAs but recommends policy NAT, instead. I'm not familiar enough with that function to give examples, though.

1
  • Thank you for the answer. In the past I've already faced this kind of problem with iptables. The solution was to DNAT (prerouting) all the queries intended to an outside DNS server to our DNS server. I'm wondering if there is a more fashionable way to do the same. Jan 22, 2014 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.