Prevent DNS Work-Around for Users

Prevent DNS Work-Around for Users

Some users on your network may try to bypass ScoutDNS resolvers by changing the DNS servers in their device network settings when allowed. This can result in undesired content access on network assets along with increased security risk. The good news is that DNS bypassing can be prevented with proper firewall rules and network configuration.

 

Setting DNS configuration network wide will prevent most users from trying to bypass the system. Most routers and firewalls allow you to force all DNS traffic over port 53 on the router/firewall. In additional you can create firewall rules that allow only ScoutDNS resolvers while blocking all others.

 

Firewall Rules

While exact commands may vary based on device you essentially want to create rules like this:

ALLOW TCP/UDP IN/OUT to xxx.xxx.xxx.xxx on Port 53

and

BLOCK TCP/UDP IN/OUT all IP addresses on Port 53

 

On some firewalls you may have to create a separate rule for each protocol instead of one for both.

 

Due to the huge number of devices on the market, ScoutDNS is unable to provide support for your specific firewall/router. Please consult your manufacturer if you require assistance. 

 

 


    • Related Articles

    • Mixing DNS Providers

      It is generally not recommended to mix DNS providers. Most routers and systems will randomly select which DNS server receives which packets. This will certainly cause problems in both filtering and reporting due to mixed rules in system cache. This ...
    • Quick Start Setup Guide

      This guide will walk you through the steps needed to configure ScoutDNS to your network. Step 1: Register Network IP ScoutDNS operates as a closed/private DNS resolver. This helps to improve security and prevent system abuse by third parties. As a ...
    • Add System Users - Role Based Access

      ScoutDNS supports Role Based Access allowing multiple operators within a single account to access the system.   Roles There are three possible roles in any account. Super Admin: One per account. Can create and remove and users. Has access to create, ...
    • DNS IPs List

      ScoutDNS operates a global anycast network for resiliency and performance. All resolver IP addresses can be found within the application under the Help Icon > IPs list ScoutDNS maintains a closed/private resolver network for security and performance. ...
    • YouTube Restricted Mode Explained

      ScoutDNS supports YouTube's restricted modes to provide a level of content control on the YouTube platform. While individual videos cannot be allowed or blocked at the URL level, Google G Suite users can approve individual videos for users within the ...