Configuring CoreDNS Zero Trust Egress Mode

Zero Trust Egress mode in CoreDNS enables administrators to restrict network access to only remote hosts that have been resolved via CoreDNS. This is accomplished with connection tagging, handled internally by CoreDNS, and manual firewall rules.

See also

How It Works

With Zero Trust Egress mode active, CoreDNS adds its own set of internal firewall rules which tag all connections as being blocked. This tagging has no effect without separate rules which act on the tagged connections.

When a client resolves a hostname through CoreDNS, CoreDNS remembers the IP addresses in the response and adds those to a special table for that client. CoreDNS tags connections from that client to the resolved addresses as being allowed. Again, manual firewall must act on these tagged connections.

With appropriate firewall rules in place, if a client does not use CoreDNS to resolve hosts, or attempts to contact an IP address without resolving it through CoreDNS first, the firewall will reject the connection attempt.

This gives administrators assurance that users are only reaching hosts resolved through CoreDNS, and clients are subject to restrictions placed on resolving via CoreDNS expressions or other features that leverage CoreDNS, such as ThreatGate.

Tip

No such control system will ever be perfect, but this technique can help with many common users and scenarios. Keep in mind that if a client can resolve a host and connect to that host, they could tunnel or proxy around these protections. That’s why the best practice is to combine this with other forms of traffic control and identification, such as an IDS/IPS and other block lists.

Prerequisites

Before starting this recipe, enable and configure CoreDNS as described in the recipe Configuring the CoreDNS Service.

Configure CoreDNS

Starting from within the Nexus instance configuration GUI:

  • Navigate to Services > CoreDNS

  • Set the Zero Trust Egress slider to On

  • Click Save

Configure Firewall Rules

As mentioned previously, CoreDNS tags the connections, but it does not pass or block anything directly. This section covers how to configure firewall rules to enact CoreDNS Zero Trust Egress mode protections.

This figure depicts the minimum set of firewall rules for an interface with clients, such as a LAN:

../_images/nexus-coredns-zero-trust-egress-rules.png

CoreDNS Zero Trust Egress LAN Firewall Rules

Configure these rules as follows, but do not apply changes until all rules have been added and placed into the appropriate order.

  • Open the pfSense Plus GUI

  • Navigate to Firewall > Rules

  • Change to the appropriate tab for the interface, e.g. LAN

  • Click fa-turn-down Add to add a new rule to the bottom of the list.

  • Configure the rule as follows:

    Action

    Pass

    Protocol

    TCP/UDP

    Source

    LAN subnets

    Destination

    LAN address

    Destination Port Range

    DNS (53)

    Description

    Allow DNS only to CoreDNS

  • Click Save

  • Click fa-turn-down Add to add another new rule to the bottom of the list.

  • Configure the rule as follows:

    Action

    Pass

    Protocol

    Any

    Source

    LAN subnets

    Destination

    Any

    Description

    CoreDNS tagged allowed

  • Click fa-cog Display Advanced

  • Set Tagged to coredns_allow

    Warning

    This value goes in the Tagged field, do not set anything in Tag

  • Click Save

  • Click fa-turn-down Add to add another new rule to the bottom of the list.

  • Configure the rule as follows:

    Action

    Reject

    Note

    Using Reject is nicer to clients, they will immediately receive an error instead of having to wait for a timeout.

    Protocol

    Any

    Source

    Any

    Destination

    Any

    Description

    CoreDNS tagged denied

  • Click fa-cog Display Advanced

  • Set Tagged to coredns_deny

    Warning

    This value goes in the Tagged field, do not set anything in Tag

  • Click Save

  • Drag and drop the rules as needed into the existing ruleset, maintaining this specific order, then Save

  • Remove any rules no longer needed, such as any default allow rules

  • Click Apply Changes

With these rules in place, Zero Trust Egress mode protections are now fully active!

Other rules can be added above these rules to manage connections as needed. For example, to always pass connections to internal or VPN resources on other interfaces, or resources that work by direct IP address access (e.g. PBX). Place Pass rules for those resources before the rules that match connections tagged by CoreDNS.

Redirect Other DNS Queries

It is critical that clients only use CoreDNS as their DNS server for High Security mode to function. However, some clients may have hardcoded DNS server addresses or other behaviors which complicate the situation.

Fortunately, it is possible to redirect DNS requests to accommodate many such clients and also ensure other users are directed to CoreDNS appropriately.

This procedure is covered in Redirecting Client DNS Requests.

Note

This redirection does not work for other DNS resolution methods such as DNS over TLS (DoT) or DNS over HTTPS (DoH). Clients attempting to use those DNS servers will have to adjust their settings to use CoreDNS instead.

Test Clients

At this point the best practice is to ensure clients are properly resolving through CoreDNS and are being blocked appropriately otherwise.

Using a client device, attempt the following actions using different websites for each test to rule out any cached DNS responses:

  • Attempt to reach a site directly using its IP address, which should fail.

  • Load a website in a browser as normal using its hostname, which should succeed.

  • Configure a client manually to use an alternate DNS source (e.g. enable strict DNS over HTTP mode in Firefox) and then attempt to browse to a site, which should fail.