Principles:

DNS Transparent Proxy enables intelligent forwarding and policy-based control of DNS requests without the need to modify configurations on endpoint PCs. The DNS resolution process is as follows:

An internal user sends a DNS resolution request to any DNS server. The request may be destined for an internal DNS server or a public DNS server.
When the DNS request passes through Athena NGFW, Athena NGFW checks whether the requested domain name is included in the internal domain name list uploaded to Athena NGFW.
If the requested domain name is in the internal domain name list, Athena NGFW uses the internal DNS server for resolution, and returns the resolution result to the user.
If the requested domain name is not in the internal domain name list, Athena NGFW forwards the request to a public DNS server for resolution, and returns the resolution result to the user.
The user receives the DNS resolution result returned by Athena NGFW, thereby enabling transparent DNS management and policy control.

descript

Difference between DNS Proxy and DNS Transparent Proxy: When DNS Proxy is used, users need to set the DNS server address to the IP address of an Athena NGFW interface. When DNS Transparent Proxy is used, users do not need to modify DNS configurations.

Configuration steps and example

1. Background:

An internal DNS server (192.168.1.10) is deployed in an enterprise network to resolve internal domain names (such as erp.company.local and oa.company.local), and employees need to access public domain names. The enterprise does not want employees to manually modify DNS configurations. The enterprise wants to achieve the following goals without user awareness: internal domain names are resolved by the internal DNS server, whereas public domain names are resolved by a public DNS server.

2. Objectives:

Through the DNS Transparent Proxy feature, internal endpoint PCs can access internal domain names without the need to modify DNS configurations. When users access internal domain names, DNS requests are automatically forwarded to the internal DNS server (192.168.1.10) for resolution. When users access public domain names, DNS requests are forwarded to the external DNS server (114.114.114.114) for resolution. This enables precise domain name resolution routing without affecting user experience.

3. Prerequisites:

Athena NGFW has normal network connectivity and can access the internet (for example, Athena NGFW can successfully ping www.baidu.com). In addition, Athena NGFW can communicate with the enterprise internal DNS server.

4. Topology:

descript

Configuration parameters:

Parameter	Description	Remarks
DNS Transparent Proxy	Enable: Athena NGFW intercepts DNS requests passing through it, uses the internal DNS server or external DNS server for resolution based on the domain name list, and returns the resolution results to endpoint PCs. Disable: DNS requests are forwarded through the original path.	This is applicable to scenarios where the DNS server settings on internal endpoints do not point to Athena NGFW, but DNS requests pass through Athena NGFW. In these scenarios, centralized DNS management is required, but users are not allowed to modify their DNS configurations.
External DNS Server	Domain names that are not included in the domain name list are resolved by using this server.	Use a reliable public DNS server.
Local DNS Server	Domain names included in the domain name list are resolved by using this server.	Configure the address of the internal DNS server.

6. Configuration steps:

Step 1. Go to Network > DNS > DNS Transparent Proxy.

Step 2. Select Enable for DNS Transparent Proxy.

Step 3. Configure External DNS Server.

Specify the address (such as 114.114.114.114) of the external DNS server for DNS Transparent Proxy. After DNS Transparent Proxy is enabled, domain names not included in the uploaded domain name list are resolved through the configured external DNS server.

Step 4. Configure Local DNS Server.

Specify the address (such as 192.168.1.10) of the internal DNS server for DNS Transparent Proxy. After DNS Transparent Proxy is enabled, only the domain names included in the uploaded domain name list are resolved through the configured internal DNS server.

Step 5. Upload the domain name list.

In the lower part of the page, click Select next to the Upload Domain File field to upload the domain names (such as company.local) that need to be resolved by the internal DNS server.

Upload Domain File: Before you use the DNS Transparent Proxy feature, upload the domain name list. Commonly used internal domain names are supported.

7. Result verification:

• On an internal endpoint PC, run the nslookup command to query an internal domain name included in the uploaded domain name list (such as erp.company.local), and confirm that the domain name is resolved through the internal DNS server.

• Run the nslookup command to query another domain name (such as www.baidu.com), and confirm that the domain name is resolved through the external DNS server.

descript

{{ $t('index.defaultHeader.logo') }}

Athena NGFW (Next-Generation Firewall)

Introduction and Configuration of DNS Transparent Proxy