I think I have this configured correctly to drop any DNS query out to the open internet:
Last match wins, correct?
Sadly, tcpdump is telling me no bueno:
17:51:23.370149 IP 10.41.32.33.33991 > 18.104.22.168.53: 63725+ A? captive.roku.com. (34)17:51:23.370306 IP 10.41.32.33.45656 > 22.214.171.124.53: 19954+ A? captive.roku.com. (34)17:51:23.395031 IP 126.96.36.199.53 > 10.41.32.33.45656: 19954 5/0/0 CNAME d1k85ogl73rd7b.cloudfront.net., A 188.8.131.52, A 184.108.40.206, A 220.127.116.11, A 18.104.22.168 (141)17:51:23.406605 IP 22.214.171.124.53 > 10.41.32.33.33991: 63725 5/0/0 CNAME d1k85ogl73rd7b.cloudfront.net., A 126.96.36.199, A 188.8.131.52, A 184.108.40.206, A 220.127.116.11 (141)
This is all DNS traffic to Google's DNS servers. I do not know why you would want to block it, nor that you can block it with firewall rules.
The firewall rules are only activated if traffic bypasses all of the proxies. (Read the articles in the Wiki section.) In this case, I think the DNS subsystem acts like a proxy so the firewall rules are not evaluated.
The firewall live log has less data than the full log. If logging is enabled for a rule, a log entry is created for each packet, and the rule number is in the log entry. Judicious use of Allow Rule logging can help hunt down unexpected firewall behavior, as long as the packet is actually handled by the firewall rules.
DouglasFoster said:This is all DNS traffic to Google's DNS servers. I do not know why you would want to block it, nor that you can block it with firewall rules.
(I also don't know where to enable it at)
I then started getting matches and more importantly drops:
Thanks for the help!
Glad it is fixed. To correct something that I said:
DNS service is always active, because UTM uses its internal DNS for its own lookup requirements.
However, you can prevent it from servicing other clients by leaving the Allowed Networks list for DNS server empty, which is apparently what you have done.
This will force the traffic to the Firewall Rules, where it is evaluated from low to high, as you confirmed.