Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 56 replies
  • Answers 1 answer
  • Subscribers 12 subscribers
  • Views 379148 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[SOLVED]DNS best practice?

tbrandl

There are two ways to configure DNS:

One way:
- Allowing DNS outgoing for your internal nameservers
- internal nameservers forwarding to ISP-DNS
- ASG pointing to internal nameservers 

Another way:
- ASG forwarding to ISP-nameservers
- "request routing" on ASG for internal domain pointing to internal nameservers
- internal nameservers forwarding to ASG
 
Which way do you use? And why? Which is "officially preferred"?
Both configurations seem working good for me, we run the first alternative on our cluster, the second in branch offices without internal dns (domain dns reachable via site2site-vpn).

Thanks for your ideas!
Thomas



BAlfson's DNS Best Practice's post has been moved to it's own highlighted thread here: https://community.sophos.com/utm-firewall/f/recommended-reads/122972/dns-best-practice
[edited by: FloSupport at 11:12 AM (GMT -7) on 18 Sep 2020]
Parents
  • 0
    Here's the thing

    connecting a PC with OpenVPN to PrivateInternetAccess (PIA)
    uses:  UDP port 9201, 1194, 8080 and 53 as well as TCP port 443, 110, 80

    the gateway I want to connect to is: "us-east.privateinternetaccess.com"

    PIA has DNS servers wich are: 209.222.18.222 and 209.222.18.218

    my concerned PC is : device_A

    I have 1x External interface, 1x Internal interface
    If someone can explain me how to apply what is described in that article: UTM: Accessing Internal or DMZ servers from Internal Networks using DNAT

    and 4x spare interfaces
    in case someone would explain me how to make 1x that is DMZed 

    thanks
Reply
  • 0
    Here's the thing

    connecting a PC with OpenVPN to PrivateInternetAccess (PIA)
    uses:  UDP port 9201, 1194, 8080 and 53 as well as TCP port 443, 110, 80

    the gateway I want to connect to is: "us-east.privateinternetaccess.com"

    PIA has DNS servers wich are: 209.222.18.222 and 209.222.18.218

    my concerned PC is : device_A

    I have 1x External interface, 1x Internal interface
    If someone can explain me how to apply what is described in that article: UTM: Accessing Internal or DMZ servers from Internal Networks using DNAT

    and 4x spare interfaces
    in case someone would explain me how to make 1x that is DMZed 

    thanks
Children
No Data
Unfiltered HTML