Hi everyone! I'm setting up a new XGS firewall for our small office and I need some help. We have an internal Pi-hole server for DNS filtering and ad blocking. I want to make sure *all* DNS queries from our LAN clients go to it, and that clients can't bypass it by using external DNS like 8.8.8.8.
I've seen some older guides for UTM using firewall rules and NAT, but I'm not sure how to do this on the newer XGS platform. Can someone walk me through the steps? Mainly, how do I force the DNS redirect properly? Thanks in advance! 😊
You've got the right idea forcing it at the firewall level! On the XGS, you'll want to use a DNS security policy. Head to Security Services > DNS Security, create a new policy for your LAN zone, and set the "DNS Query Mode" to "Forward to internal DNS server."
The key step is adding a firewall rule to block all outbound DNS (UDP/TCP 53) from your LAN, except from your Pi-hole's IP address. That stops any bypass attempts to 8.8.8.8. Just make sure your Pi-hole is set as the DHCP-provided DNS, and this locks it down nicely.
I've been running this exact setup for about a year - it's solid. Let me know if you hit any snags with the policy setup!
Data doesn't lie, but dashboards sometimes do.