Force DNS clients must use behind PIX firewall
I am trying to ensure that regardless of what DNS server clients may have specified in thier IP properties, that my internal DNS server is ALWAYS the one that gets used. A memeber of another forum suggested the following...
route-map dns-redirect permit 10 match ip address 110 set ip next-hop 192.168.0.8
access-list 110 deny tcp any any neq dns access-list 110 deny tcp host 192.168.0.8 any access-list 110 permit tcp any any
int fa0/0 ip policy route-map dns-redirect
...I get the idea, but it doesn't work - and as I understand it route-map is only supported on the PIX for use in BGB routing?
How can I accomplish this on the PIX (if so) and if not, what is the smallest/cheapest router that can do this? I am open to any suggestions, or config changes, keep in mind I'll need to place the router on the INSIDE PIX interface so this route-map rule doesn't mess up lookups comming from the internal DNS server to an external DNS server (My ISPs/DNS Forwarders)
This is intentionally the way I want to do it, unfortunatly I cannot enforce that users (lots who are clever, and local admin of thier machines) use my internal DNS server as handed out via DHCP.
read more and respond »Posted 5 years ago by JPElectron in Cisco Systems
