Dns Resolution to external dns server from dmz

Answered Question
Aug 1st, 2010

Hi,

I am struggling with dns resolution from a machine located in the dmz. The Inside machines are ok but I want  only 1 machine in the Dmz to be able to access the Internet. I have configured the following and I can use the IP address in the browser and pull up a page ok, but not using nslookup on the PC or via the browser. The PC has an external dns server configured 195.14.130.170. I configured the following but just cant get dns queries to work. One extra complication is that there is a vpn configured and this same host is accessed via the vpn (this bit works ok). Have I configured this ok to allow the vpn to configure working and allow this host internet access?

nat (dmz) 1 access-list dmz_nat_outbound

object-group service webservices tcp-udp
port-object eq www
port-object eq 443
port-object eq domain

access-list dmz_nat_outbound extended permit tcp 192.168.20.10 any object-group webservices

I have this problem too.
0 votes
Correct Answer by Rahul Govindan about 6 years 4 months ago

Can you run a packet tracer

packet-tracer input inside udp 192.168.20.10 53 195.14.130.170 53 detailed

Also you could try this:

add another line to the access-list

access-list dmz_nat_outbound extended permit udp 192.168.20.10 any domain

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Rahul Govindan Sun, 08/01/2010 - 05:44

Can you run a packet tracer

packet-tracer input inside udp 192.168.20.10 53 195.14.130.170 53 detailed

Also you could try this:

add another line to the access-list

access-list dmz_nat_outbound extended permit udp 192.168.20.10 any domain

communications_2 Wed, 08/04/2010 - 11:41

Hi Rahgovin,

Thanks for responding, I noticed that I had specified TCP in the access list even though I had added domain to the port object group.

Thanks for your Help.

Actions

This Discussion