[USG Flex H] - Resolve A Record only from selected interfaces

Options
Maverick87
Maverick87 Posts: 427 image  Master Member
Zyxel Certified Network Administrator - WLAN Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate
in Security Ideas

Hello,

As per request:

https://community.zyxel.com/en/discussion/33876/usg-flex-h-resolve-a-record-only-from-selected-interfaces

I've configured an A Record DNS entry:

xyz.no-ip.org —> 192.168.0.1

This host is an DDNS that, externally, resolve with my external WAN IP.

Now, internally, when I try to resolve xyz.no-ip.org, the gateway return to me 192.168.0.1 as per A Record entry, externally resolve with the WAN IP correctly.

This happens from all interfaces that I've defined.
There is a possibility to resolve the DDNS hostname with the real IP only from selected interfaces?

Example:

  • VLAN 10 (subnet 192.168.10.0/24) —> 192.168.0.1
  • VLAN 20 (subnet 192.168.20.0/24) —> 192.168.0.1
  • VLAN 100 (subnet 192.168.100.0/24) —> 84.87.XXX.XXX
1
1 votes

Declined · Last Updated

No plan currently.

Comments

  • Zyxel_Melen
    Zyxel_Melen Posts: 5,085 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    Options

    Hi @Maverick87

    Thank you for the detailed write-up and the clear example — it's a well thought-out scenario.

    We've discussed this internally, and at this time there are no plans to add native per-interface/VLAN-aware behavior to the DNS Server module (i.e., having a single A Record entry resolve differently depending on which VLAN/subnet the query originates from). The current DNS Server applies A Record overrides globally across all interfaces that use it as their DNS server, and this isn't on the roadmap for the near term.

    Suggested workaround:

    For the VLAN(s) where you want clients to resolve to the real external IP (e.g., VLAN 100 in your example), you can combine a DHCP option change with a Security Policy rule:

    DHCP Option 6 (DNS Server): In that VLAN's DHCP scope, set the DNS server to an external/public resolver (e.g., 8.8.8.8) instead of the gateway's own IP.
    Security Policy: Add a rule blocking DNS queries from that VLAN to the gateway itself — From: VLAN100, To: ZyWALL, Service: DNS, Action: Deny.

    The second step is important: without it, clients could still reach the gateway's local DNS Server directly (bypassing their assigned DHCP DNS setting) and get the A Record override. Blocking DNS to the ZyWALL from that VLAN forces clients to use the external DNS server, which resolves xyz.no-ip.org to the real WAN IP.

    VLAN 10 and VLAN 20 would keep the gateway as their DHCP-assigned DNS server (no policy change needed), so they'd continue getting the A Record override (192.168.0.1) as before.

    We appreciate you taking the time to submit this.

    Zyxel Melen


  • PeterUK
    PeterUK Posts: 4,718 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    Options

    or run your own bind

  • Maverick87
    Maverick87 Posts: 427 image  Master Member
    Zyxel Certified Network Administrator - WLAN Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate
    Options

    Hello @Zyxel_Melen,

    thank you for your suggestion… yes obviously in this case can works as expected but the VLAN resolve via a public DNS, and this implicates that I'm unable to resolve some other A Record DNS entry locally.

    But this is the game of balance, it has to tip somewhere.

    Thank you so much, I hope this request will be taken into consideration soon.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）