Before we get started, this guide assumes you already have a standard network setup with both RED and GREEN networks created, up and working.
This guide will be split based on sections. So without further ado let’s get started.
- Service Groups
-
As first step you would need to log into your IPFire web panel, hover over Firewall and select Firewall Groups.
-
In Firewall Groups you will need to select Service Groups, in Add new service group give it a group name and in Remark add something that will remind you of what this group service does, once than that hit Add.
-
On the next page in the Add selection you will need to select DNS TCP and click on Add. Do the same but this time select DNS UDP.
- Firewall Rules
-
From within the IPFire web panel, hover over Firewall, select Firewall Rules, and select New Rule.
-
In Source select Standard networks and choose GREEN.
-
In Destination select Standard networks and choose RED.
-
In Protocol you will need to select - Preset -, select Service Groups, choose DNS TCP and DNS block, and select REJECT.
-
In Additional settings you would want to select Log and Active Rule.
-
Once done that, simply click on Update.
NOTE: Repeat the same steps if you want to block external DNS server usage for UDP traffic.
- Firewall Rules (Incoming Firewall Access)
-
Assuming we are still inside the Firewall Rules page, you would want to select New Rule so that we can create our very last rule.
-
In Source select Standard networks and choose Any.
-
In Destination select Firewall and choose GREEN.
-
In Protocol select - Preset -, select Service Groups , choose DNS TCP and DNS block, and select ACCEPT.
-
In Additional settings you would want to select Log and Active Rule.
-
Once done that, simply click on Update.
Congratulations. If you have followed these steps correctly and your configuration looks like mine (see screenshots), you should have successfully blocked external DNS server usage.
What will happen if somebody is using external DNS server is simply that the browser will remain on a loop in a blank page waiting for the DNS server to reply.
Additionally, if you want to restrict IP’s and domains access you would want to combine this guide alongside with my blocked hosts megalist; (please read more here), which will ensure that a good amount of websites containing spam, malware, viruses, ads etc will be blocked within the entire LAN.
Please feel free to share any thoughts or feedbacks you may have.