Sophos xg can't resolve own hostname and internal server

the first step would be to check if DNS is allowed on the Zone.

An other useful thing is packet capture

you can see if and probably why something like DNS is blocked

DNS is enabled in the zone LAN

Here is the result from the packet capture. Where can I see here if it has been blocked?

Here is the result of nslookup:

nslookup schneckenxg
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  172.16.0.2

Nicht autorisierende Antwort:
DNS request timed out.
    timeout was 2 seconds.
Name:    schneckenxg
Address:  172.16.0.2

172.16.0.2 is the LAN Interface
172.16.3.103 is the client

Yes,  it is but on the internal side not the external side. You need to provide some external DNS access to resolve lookups.

Ian

Hello Ian,

thanks for the answer

Doesn't the lookup of external names work automatically via the WAN interface? I am not sure what I need to change.

Sorry for possible stupid questions.

Regards
Marc

But, you have told the WAN interface to use the internal address of the XG as its lookup.

In the DNS settings change the DNS to use DHCP settings for the WAN interface or used fixed as you have.

I have mine set to use my ISP's DNS IP4 and IPv6, alot of people use 8.8.8.8 or 4.4.4.4 or 1.1.1.1 which are a mix of Google and Cloudflare DNS.

Ian

Hi Ian,

now I changed DNS 1 to 8.8.8.8 and the dns query configuration

The network configuration on my client looks like this:

   IPv4-Adresse  . . . . . . . . . . : 172.16.3.100
   Subnetzmaske  . . . . . . . . . . : 255.255.248.0
   Standardgateway . . . . . . . . . : 172.16.0.2 (XG)
   DNS-Server  . . . . . . . . . . . : 172.16.0.2(XG)

Unfortunately, it still doesn't work.

Even ipconfig /flushdns on the client does not help.

Regards

Marc

Please remove the 127 address, that is an internal nonevroutable address and should not be on the external interface.

then allow time for the XG to update its tables.

ian

Hi Ian,

I have now removed 127 and waited about 3 hours. Unfortunately without success. Restarting the XG does not work either.

What I notice is that when I execute the following command on my client, a DNS error occurs:

    netsh interface ipv4 set dnsservers name="Ethernet 2" static 172.16.0.2

    The configured DNS server is incorrect or does not exist.
    
Any idea?

Regards

Marc

from your screenshots the XG is now using 8.8.8.8 as primary DNS. It should now be able to resolve names on it's own.

btw. the 127.0.0.1 should be OK to stay there as second resolver. This would be the only way to resolve names, that are only configured on the XG with static mappings.

On XG when you go to diagnostic > tools > name lookup

Select lookup using all configured servers

can you resolve external FQDN?

initB10r said:

DNS is enabled in the zone LAN

Here is the result from the packet capture. Where can I see here if it has been blocked?

scroll to the right side in that results window. if you see something like violation there, it's blocked. Consumed means, the (DNS-) Packet was for the XG itself and is "consumed", so not forwared to someone else.

external FQDN works fine

I turned the packet capture on again and pinged the name of the XG. Here is the result:

violated I can' t find but some consumed

I turned the packet capture on again and pinged the name of the XG. Here is the result:

violated I can' t find but some consumed