Prevent Unauthorized DNS Traffic on Clavister
Overview
This guide explains how to configure explicit firewall policies on Clavister cOS Core to ensure all network traffic is properly filtered. By implementing these rules, you will allow DNS queries exclusively toward the FlashStart cloud platform while blocking any unauthorized external or hardcoded public DNS servers.
Rule order is critical on Clavister cOS Core. The firewall evaluates rules sequentially from top to bottom. Ensure Allow_DNS is placed above Block_DNS, and that both rules sit above your general LAN-to-WAN internet access rule.
Create the Allow Rule for FlashStart DNS
To permit legitimate DNS traffic toward the protected cloud servers:
Navigate to Policies in the top menu, expand Firewalling, and click on Main IP Policies.
Click on Add and select IP Policy to create the allow rule at the top of the list:
- Name: Allow_DNS
- Action: Set to ALLOW (toggle enabled)
- Interface (Source): Select your internal LAN interface, such as If1
- Network (Source): Select your local network object, such as If1_net
- Interface (Destination): Select your external WAN interface, such as If2
- Network (Destination): Select your FlashStart DNS group object, such as FlashStart_DNS_Group
- Service: Select dns-all
Click OK at the bottom of the form.
Create the Block Rule for Unauthorized DNS
To intercept and drop any attempts to query alternative or external DNS servers:
Immediately below the allow rule, click on Add and select IP Policy to create the blocking rule:
- Name: Block_DNS
- Action: Set to DENY
- Deny Behavior: Set to DROP
- Interface (Source): Select your internal LAN interface (If1)
- Network (Source): Select your local network object (If1_net)
- Interface (Destination): Select your external WAN interface (If2)
- Network (Destination): Select all-nets
- Service: Select dns-all
Click OK at the bottom of the form.
Save and Activate
To apply your new firewall policies on Clavister cOS Core, click on Configuration in the top-right bar and select Save and Activate, then click OK to confirm.