Security Gateway Manual Netgate-4200
• Navigate to System > Routing, Gateways tab
• Set Default gateway IPv4 to PreferWAN
• Click Save
• Click Apply Changes
Note: This is important for failover from the firewall itself so it always has outbound access. While this also enables
basic failover for client traffic, it’s better to use policy routing rules to control client traffic behavior.
2.5.7 DNS
DNS is critical for Internet access and it is important to ensure the firewall can always resolve hostnames using DNS
even when running on a secondary WAN.
The needs here depend upon the configuration of the DNS Resolver or Forwarder.
If the DNS Resolver is in its default resolver mode, then default gateway switching will be sufficient to handle failover
in most cases, though it may not be as reliable as using forwarding mode.
If the DNS Resolver is in forwarding mode or the firewall is using the DNS Forwarder instead, then maintaining
functional DNS requires manually configuring gateways for forwarding DNS servers.
• Navigate to System > General Setup
• Add at least one DNS server for each WAN in the DNS Server Settings section, ideally two or more. Click
Add DNS Server to create additional rows.
Each entry should be configured as follows:
Address
The IP address of a DNS server.
Each server address must be unique, the same server cannot be listed more than once.
DNS Hostname
Leave this field blank unless the server will be contacted using DNS over TLS through the DNS
Resolver. In this case, enter the FQDN of the DNS server so its name can be validated against its
TLS certificate.
Gateway
Select a gateway for each DNS server, corresponding to the WAN through which the firewall can
reach the DNS server.
For public DNS servers such as CloudFlare or Google, either WAN is OK, but if either WAN
uses DNS servers from a specific ISP, ensure those exit the appropriate WAN.
Note: If the gateway drop-down does not appear next to each DNS server, then the firewall does
not have more than one gateway configured for any address family. Double check the gateway
settings for all WAN interfaces.
• Uncheck DNS Server Override
This will tell the firewall to use the DNS servers entered on this page and to ignore servers provided by dynamic
WANs such as DHCP or PPPoE. Occasionally these providers may push conflicting DNS server information so
the best practice is to assign the DNS servers manually.
© Copyright 2024 Rubicon Communications LLC 52
To Next Page
Loading...
