<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2524 " id="quads-ad2524" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<p>Let&#8217;s assume that you have installed and configured Squid Proxy to block several categories of websites that you don&#8217;t want your users or clients to visit .. </p>
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2528 " id="quads-ad2528" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2530 " id="quads-ad2530" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2523 " id="quads-ad2523" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>




<p>In some places maybe interference on client machines or applying group policy on AD is not strict thing and might give the option to users to pass through proxy rules .. so I have considered the same thought and said after I have configured squid proxy to block certain websites (Porn, chat, social&#8230;etc) using the Wpad autodiscover method.. I said in case I change the DNS the user will pass through the proxy and find away to connect to those blocked websites. </p>



<p>Then I thought what if I can block external DNS queries and let all the DNS queries pass through the Pfsense or my internal DNS..</p>



<p>To do so I have configured my PFsense&#8217;s WAN DNS IP to Google (System>;General Setup>; </p>



<figure class="wp-block-image"><img src="https://lh6.googleusercontent.com/TtSK30UzmbEEvJkLqvG-NhR54m6E2NPc1VRSCz0gct3_vm_jC_LloBgMlawHPz3BpI2s7yJUH8QGHqZBndTorLc5bHYlbj2pq-RKXvqutl92gb6sBmM-=w1175" alt=""/> 

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2526 " id="quads-ad2526" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
 
</figure>



<p>I have added my Local DNS to the DNS resolver (Pfsense Version 2.2) </p>



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/Kq0iSAluAzq2ma3wwWtAtkiMHORbpLbIP-OMJfnmSFZO9kHlP7inJzAhMP7-ZceGZNJjJL-v82EQPqj_MY9qadoRF-sy9H5N8NFP81IMWiKLucvzDkI=w1175" alt=""/></figure>



<p>Next I will go to the Rules and go to my LAN (DMZ in my case) and create 3 rules in total as following:</p>



<p>The rules in the figure below will allow any DNS query request from any source through only (Local Address of the Pfsense) and the second rule will allow DNS requests from the local DNS Server to any DNS server. </p>
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2522 " id="quads-ad2522" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>




<p>Third rule will blcok any DNS request from anywhere else. </p>



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/kDyHscAQvIFCcMLDDcLIuuWLY7n-tYI87j8ujn_-rWH74qp7hp_6EdYFlEE_fHwfgWMDYIllvQvhXSD23bsOzJT5vZYyvshnslUbtRzOZUDIt99fclg=w1175" alt=""/></figure>



<p>Which in result will allow all clients to forcefully use the local DNS to resolve names and resolve IPs, but still even if the user changed his Local LAN/Wifi DNS IP to Google still he&#8217;ll be able to connect to the allowed websites from SQUID but he/she won&#8217;t be able to resolve FQDNs through (Nslookup command) for example. </p>



<p>I&#8217;m attaching screenshots to demonstrate how this is working flawlessly. </p>



<p>As you can see below I have opened google, Flickr, Facebook, gmail, searched for local time and it all worked according to the Squid rules and while still using (8.8.8.8) </p>



<figure class="wp-block-image"><img src="https://lh5.googleusercontent.com/TNSEZokVxzmAk1UMa2AzflzjOenUyRypPacqT_AtKALi2oydzlqxkaQLd6ktH_UorEyhpC7weseJFNePBQ5maBL0RAQ3Gf3ZwpLhCq4rQfUqcaWH1AY=w1175" alt=""/></figure>



<p>Now I will change the DNS back to the local DNS IP and see if i can resolve internet addresses without an issue and connect as well, which worked fine too.</p>
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2531 " id="quads-ad2531" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>




<figure class="wp-block-image"><img src="https://lh5.googleusercontent.com/4vLZ2ZAAKEoeomnY7FJIHEXP535Kfch1qdqziI0ebehsg7q7m087w4rva8SDf5s8xOiOjgkNx-qFEEI2AIvIEkwvDYaUIJm880rQAlAgNFk12I5Qmck=w1175" alt=""/></figure>



<p>This is a simple article but I&#8217;m sure it could be very useful for those companies who want to block wide range of categories and force it on to their employees. or for families who want to avoid their kids from doing naughty stuff or watch violent websites. <br></p>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2527 " id="quads-ad2527" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>


Reset and manage your Active Directory users' Passwords Active Directory is one of the most…
Finding Exchange Database hidden mailboxes. Story:Maybe you have been in this situation before, trying to…
If you're using a Proxy server in your firewall or in your network and have…
Story:I got some clients that have reported some of their users being locked out and…
Delegate Permissions This is a code that I have wrote recently to check if an…
Story: I got a request from a client who constantly gets CVs and have to…