Configuring Your Network

After you have Tested Your Connection with one computer to DNSFilter servers, you can change your network configuration to point all outbound DNS traffic to our servers. This will ensure comprehensive filtering and security coverage for all devices on your network.

Depending on how your network is set up, there are several ways to make the change:

• If you operate an Active Directory environment, you can configure DNSFilter as your Forward Zone.
• If you run a non-AD environment, you can configure DNSFilter on your:
  • Router (good for smaller networks)
  • DHCP Server (good for any size network and for use with NAT IPs)
  • Firewall (can be used standalone to force query traffic or in concert with router/DHCP options)

Configure DNSFilter on Active Directory

Many larger organizations utilize Microsoft Active Directory to manage their computing resources. DNSFilter can be configured as a Forward Zone so that your entire network is protected by a filtering Policy. Only a simple configuration change is required, and there is no interference on your LAN. You can also install our Roaming Client via Active Directory so that individual devices have different policies. This is useful in situations where staff or executives need to have an alternate policy from the main site.

As shown in the diagram below, the endpoints are already set to communicate with Active Directory for DNS resolution. When local queries are sent, the Domain Controllers resolve them. When an internet query is sent, the Domain Controller recognizes that it cannot resolve locally, so it will send the queries to DNSFilter for resolution. DNSFilter never sees or charges for your local queries.

The fastest way to configure DNS forwarding is by logging on to the Domain Controllers and issuing the PowerShell command below to replace the forwarders with the DNSFilter Anycast IPs.

# Get the current list of forwarders 
# Useful to save before overwriting 
Get-DnsServerForwarder 

# Set forwarders to DNSFilter 
Set-DnsServerForwarder -IPAddress '103.247.36.36','103.247.37.37' -UseRootHint $False -PassThru

You may also refer to the screencast below for the GUI method of replacement:

Once this has been set, changes will instantly take effect. This is because LAN devices already go to the Domain Controllers (DC's) for resolution. The DC's will now forward internet queries from all devices through DNSFilter and allow/block based on what you have set in the dashboard.

If you wish to put some devices on a different policy, you can install our Roaming Client via Active Directory.

Configure DNSFilter on Your Router

Setting DNSFilter servers on the router is a common setup for smaller locations, such as in a small office/home office (SOHO). This configuration uses the router as a DNS forwarder. Queries from network clients go to the router for resolution. The router then sends WAN queries through the network gateway to DNSFilter.

Use Cases:

• Home / Personal
• Small Offices
• No Local Authentication (Active Directory, LDAP, Radius, etc.)

Due to the variety of router manufacturers existing, DNSFilter does not provide directions for this procedure. You should easily be able to find this by searching Google for the instruction manual for your particular make and model of router. You will look to add the DNSFilter Anycast IPs into the DNS forwarding section of your router's configuration.

Configure DNSFilter on Your DHCP Server

You may use your DHCP server to hand out DNSFilter’s IPs directly to clients. Remember the warning at the beginning of this article that to do so will break local by-name resolution (e.g., Jeff-PC, Jane-Printer). On some networks, this may not be an issue, such as Guest Wi-Fi.

This configuration is also desirable for utilizing our NAT IPs feature, which allows you to create multiple filtering policies that correspond to your network subnets.

Use Cases:

• Guest Wi-Fi
• No LAN Resources (printers, servers, resource sharing)
• Utilizing the NAT IPs feature

Due to the variety of equipment manufacturers existing, DNSFilter does not provide detailed directions for this procedure. If you are using a router, this setting is commonly found under the “DHCP Server” section of the configuration. You will replace the DNS server IPs with the DNSFilter Anycast IPs. For Cisco Meraki equipment, there are instructions here.

Configure DNSFilter on Your Firewall

Hardware firewalls / virtual appliances can be configured to forward DNS queries to DNSFilter, regardless of what network clients have set on their network adapters. This is useful in scenarios where users are likely to attempt to circumvent the filtering by changing the DNS settings on their device. It is also useful if your Internet Service Provider is running a transparent proxy (redirecting DNS queries to their servers) because you can forward queries to port 5353 or 5354(UDP only).

Use Cases:

• School networks
• ISP has a transparent proxy
• Locations where users have access to change their DNS settings

To set this on your firewall, you'll create either a NAT rule or port-forwarding rule to set all UDP and TCP port 53 traffic to DNSFilter's Anycast IPs. You can check the Preventing Circumvention and Transparent Proxying articles for examples of firewall rules that can be set.

Connection Ports / Protocols

Multi-Site Environments

In a multi-site environment, systems should be configured to use the DNS servers at their local site before those at a different site. This minimizes the amount of DNS traffic crossing slower WAN links.

If you have a multi-site environment, but only a single DNS resolver for all sites, the site where the DNS resolver is located will ultimately determine the policies applied to the traffic for all sites. To allow for site-specific policies (based on each site’s IP address), the DNS queries must not traverse your WAN and instead should go directly to DNSFilter via the respective site’s internet connection. If placing DNS servers at each site is not feasible, there are a few solutions to ensure local domain DNS queries are resolved correctly, and internet domain DNS queries do not traverse your WAN to a single site:

1. Deploy Roaming Client: By installing our Roaming Client on the systems and configuring Local Domains, DNS queries for internal resources will be sent to your internal DNS resolver. While DNS queries for internet domains will be resolved by the Roaming Client and policies assigned to the Roaming Client will be enforced.
2. Deploy Relay: By placing a Relay at each site without an existing DNS resolver and configuring Local Domains. DNS queries for internal resources will be sent to your internal DNS resolver, while DNS queries for internet domains will be resolved by the Relay. Policies assigned to that relay and that site’s LAN Subnet(s) will be enforced.