End-of-Life (EoL)

Use Case 3: Firewall Acts as DNS Proxy Between Client and Server

In this use case, the firewall is located between a DNS client and a DNS server. A DNS Proxy on the firewall is configured to act as the DNS server for the hosts that reside on the tenant’s network connected to the firewall interface. In such a scenario, the firewall performs DNS resolution on its dataplane.
This scenario happens to use
split DNS
, a configuration where DNS Proxy rules are configured to redirect DNS requests to a set of DNS servers based on a domain name match. If there is no match, the server profile determines the DNS servers to which to send the request, hence the two, split DNS resolution methods.
For dataplane DNS resolutions, the source IP address from the DNS proxy in PAN-OS to the outside DNS server would be the address of the proxy (the destination IP of the original request). Any service routes defined in the DNS Server Profile are not used. For example, if the request is from host to the DNS proxy at, then the request to the DNS server (at would use a source of and a destination of
Configure a DNS Proxy and DNS proxy rules.
  1. Select
    DNS Proxy
    and click
  2. Click
    and enter a
    for the DNS Proxy.
  3. For
    , select the virtual system of the tenant.
  4. For
    , select the interface that will receive the DNS requests from the tenant’s hosts.
  5. Choose or create a
    Server Profile
    to customize DNS servers to resolve DNS requests for this tenant.
  6. On the
    DNS Proxy Rules
    tab, click
    and enter a
    for the rule.
  7. Select
    Turn on caching of domains resolved by this mapping
  8. Click
    and enter one or more
    Domain Name
    (s) for the rule, one entry per row. Reference: DNS Proxy Rule and FQDN Matching describes how the firewall matches FQDNs to domain names in a DNS proxy rule.
  9. For
    DNS Server profile
    , select a profile from the drop-down. The firewall compares the domain name in the DNS request to the domain name(s) defined in the
    DNS Proxy Rules
    . If there is a match, the
    DNS Server profile
    defined in the rule is used to determine the DNS server.
  10. Click
    to save the rule.
  11. Click
    to save the DNS Proxy.

Recommended For You