Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 23 replies
  • Subscribers 47 subscribers
  • Views 28940 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG Blocking DNS Lookup - DNS Request Timeout Error

Leebtish

Hi all,

I recently tried to point our DNS servers to our XG230 but when I run an nslookup I'm receiving the error "dns request timed out. timeout was 2 seconds".

Our setup is pretty simple. We have 2 x Windows 2012 DNS servers. Each server points to the other as the primary and then itself as the secondary. The servers are also configure to use forwarders to the local ISP. This has worked well for a long time. As soon as we point the servers to the old firewall it's fine so the problem has to be with the XG somewhere.

I have set up a network rule for the DNS servers and the logs show that traffic on UDP port 53 is being allowed to the ISP so it looks ok to me. I just can't figure out why NSLOOKUPS are timing out. The DNS settings on the XG are set to point to the internal DNS servers which is working fine.

I have read an article for the UTM which suggests that DNS should be pointed to the UTM with DNS request routing configured but we would prefer to keep our settings as they are for now.

Any suggestions?

Thanks

Lee



This thread was automatically locked due to age.
Parents
  • 0

    please post your DNS rule for us to review.

    Web Blogger at Izopc.com & Rorpc.com

  • 0 in reply to Ahmad Ali1

    Ahmad,

     

    I have done more testing and the DNS rule it is not the fix for me.

    Anyway, here it is:

    By the way, this rule does not register traffic. 

     

    I've tried more internal and external DNS servers. Some respond very quickly. Since I do not need to resolve internal addresses, it is ok for me to work with any external.

    After all, I think this is the right solution, choosing a decent DNS server.

     

    After more tests, now I'm getting "refused" by my ISP suggested DNS server.

    Trying with windows nslookup, I don't get the refused queries.

     

     

    Anyway, looking at the sophos console I have found something:

    nslookup

    The usual response with a slow DNS server, around 3 secs.

    tcpdump -ni any port 53

    4 attempts

    100.10 and 100.40 are valid DNS servers from my ISP.

    100.60 it is a bogus one, I was not expecting the refusal from the first two.

    216.239.38.10 was not on my DNS server list!!!

     

    Interestingly, I tried setting my DNS to 127.0.0.1 and the XG will resolve addresses with other DNS servers (not set by you).

     

    I'll keep testing.

Reply
  • 0 in reply to Ahmad Ali1

    Ahmad,

     

    I have done more testing and the DNS rule it is not the fix for me.

    Anyway, here it is:

    By the way, this rule does not register traffic. 

     

    I've tried more internal and external DNS servers. Some respond very quickly. Since I do not need to resolve internal addresses, it is ok for me to work with any external.

    After all, I think this is the right solution, choosing a decent DNS server.

     

    After more tests, now I'm getting "refused" by my ISP suggested DNS server.

    Trying with windows nslookup, I don't get the refused queries.

     

     

    Anyway, looking at the sophos console I have found something:

    nslookup

    The usual response with a slow DNS server, around 3 secs.

    tcpdump -ni any port 53

    4 attempts

    100.10 and 100.40 are valid DNS servers from my ISP.

    100.60 it is a bogus one, I was not expecting the refusal from the first two.

    216.239.38.10 was not on my DNS server list!!!

     

    Interestingly, I tried setting my DNS to 127.0.0.1 and the XG will resolve addresses with other DNS servers (not set by you).

     

    I'll keep testing.

Children
No Data
Unfiltered HTML