Transparent dnat

It is not in V17.5. 

We talked about this here:

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/109366/force-dns-requests-to-an-internal-server/392878#392878

I am still struggling with the reason for doing this. Would suggest to simply block everything and "force" to use XG / internal DNS. This is my all time approach to resolve this. 

Thanks for your reply Lucar, will keep an eye on that thread.

The reason behind this configuration is actually pretty simple! There are a numbers of IoT devices which just ignore the dns pulled from dhcp and keep using Google dns rather.

Block outgoing DNS requests would not solve the issue but just make these devices unusable.

Transparent dnat is the only way to force the use of the internal dns.

Thanks

Can you name such devices? This seems to be highly un-compliant to do such a behavior. And such devices would be rather in your isolated network instead of your company network. 

Most of the time, in guest networks, i allow to perform such actions. 

But if such IoT Devices are performing such stuff, i would not like to have them in the same broadcast domain. It is like some kind of "old" printer. Easy way to use them as a jumphost as a hacker. Check out the current 35C3 in Germany. 

Just my 2 Cents about this topic. It does not resolve your issue / limitation. 

Can you name such devices? This seems to be highly un-compliant to do such a behavior. And such devices would be rather in your isolated network instead of your company network. 

Most of the time, in guest networks, i allow to perform such actions. 

But if such IoT Devices are performing such stuff, i would not like to have them in the same broadcast domain. It is like some kind of "old" printer. Easy way to use them as a jumphost as a hacker. Check out the current 35C3 in Germany. 

Just my 2 Cents about this topic. It does not resolve your issue / limitation. 

Virgin Media TV Boxes (v5 in my case) ignore DNS for some of their implemented software and try to utilise Virgins DNS which if unavailable will cause some software to fail. Google Chromecasts prioritise Google but should also use local (at least in early versions). Some brands of home automated lighting uses fixed DNS as well.

Those are a few I'm aware of.