---
title: Prevent Unauthorized DNS Traffic on Clavister
slug: prevent-unauthorized-dns-traffic-on-clavister
createdAt: 2026-10-19T10:38:46.778Z
---

## Overview

This guide explains how to configure explicit firewall policies on Clavister cOS Core to ensure all network traffic is properly filtered. By implementing these rules, you will allow DNS queries exclusively toward the FlashStart cloud platform while blocking any unauthorized external or hardcoded public DNS servers.

:::hint{type="warning"}
Rule order is critical on Clavister cOS Core. The firewall evaluates rules sequentially from top to bottom. Ensure Allow\_DNS is placed **above** Block\_DNS, and that both rules sit **above** your general LAN-to-WAN internet access rule.
:::

## Create the Allow Rule for FlashStart DNS

To permit legitimate DNS traffic toward the protected cloud servers:

Navigate to **Policies** in the top menu, expand **Firewalling**, and click on **Main IP Policies**.

Click on **Add** and select **IP Policy** to create the allow rule at the top of the list:

- **Name**: Allow\_DNS
- **Action**: Set to **ALLOW** (toggle enabled)
- **Interface (Source)**: Select your internal LAN interface, such as If1
- **Network (Source)**: Select your local network object, such as If1\_net
- **Interface (Destination)**: Select your external WAN interface, such as If2
- **Network (Destination)**: Select your FlashStart DNS group object, such as FlashStart\_DNS\_Group
- **Service**: Select dns-all

Click **OK** at the bottom of the form.

## Create the Block Rule for Unauthorized DNS

To intercept and drop any attempts to query alternative or external DNS servers:

Immediately below the allow rule, click on **Add** and select **IP Policy** to create the blocking rule:

- **Name**: Block\_DNS
- **Action**: Set to **DENY**
- **Deny Behavior**: Set to **DROP**
- **Interface (Source)**: Select your internal LAN interface (If1)
- **Network (Source)**: Select your local network object (If1\_net)
- **Interface (Destination)**: Select your external WAN interface (If2)
- **Network (Destination)**: Select all-nets
- **Service**: Select dns-all

Click **OK** at the bottom of the form.

## Save and Activate

To apply your new firewall policies on Clavister cOS Core, click on **Configuration** in the top-right bar and select **Save and Activate**, then click **OK** to confirm.