Qbik Helpsys

DNS Client settings

The DNS Client settings, located at Control Panel > DNS Client in the WinGate Management console, can be used to list the DNS servers that WinGate should use.

The configuration will automatically list all DNS servers (and their use) that have been discovered through the DNS Client probe. You can configure the use of these DNS servers manually or add new DNS servers to the list as required.

Note

Any DNS servers that you manually list in the DNS Client settings, will need to be accessible to WinGate either on the LAN through its Internal network adapter, or the Internet via its Internet connection.

Settings

Enable hosts file lookup

This setting which is on by default, enables you to have the DNS Client refer to a hosts file on the WinGate server, before using the listed DNS servers.

Enable DNS cache

The DNS Client will store all the DNS records it has obtained into a cache, to help aid faster name lookup resolution for WinGate clients. By default, 20000 records will be retained in the cache at any one time. This can be altered as you require. The cache can be emptied by clicking the Empty button.

Minimum TTL

This is the minimum Time to Live (TTL) that will be applied to the DNS record when it is added to the DNS cache. The TTL is the time in seconds the record can be reused before it needs to be looked up again. If the TTL set in the record returned by the upstream DNS server is longer then this minimum value, then the longer TTL will be applied. This will also be the minimum TTL in the DNS record that WinGate will pass back to client resolvers.

Being able to set the minimum TTL helps to limit the number of lookups a WinGate client is forced to do when the DNS server responsible for the domain name sets an extremely low TTL originally. Apart from creating extra lookups, low TTLs can potentially be used in DNS redirect attacks in combination with attempted browser exploits. Having control over setting a minimum TTL is useful in lessening the chance of this happening.

To manually add a DNS server:

  1. Open the WinGate Management console
  2. Navigate to Control Panel > DNS Client.
  3. On the DNS Client settings, select the Add new button to open the DNS Server properties.
  4. Select the Enable lookups to check box (selected by default) and enter the IP address for the DNS server you wish WinGate to use.
  5. The Probe for loops / usage checkbox is selected by default to allow for the DNS Client to check for what type of records the DNS server is capable of resolving. If you don't wish for the DNS Client to probe the DNS server, then deselect this option. This is usually done when you are manually setting what type of records the DNS server should be used for. Manual classification is achieved by selecting either of the Use server for Internet lookups, or Use server for local lookups check box options. You can also enter the local domain(s) that the DNS server is responsible for by clicking the Add new button and entering the fully qualified domain name(s).

    Note

    Loop protection

    In previous versions of WinGate, you were required to manually list all DNS servers that WinGate shouldn't use to prevent looping across the network. This would occur most commonly when WinGate was located in an Active Directory, where the Active Directory DNS server was only capable of resolving records for the Active Directory domain (i.e. Not connected to the Internet). Often in this scenario, the WinGate DNS service on the WinGate server could be used as the Forwarder that the Active Directory DNS Server would use to perform Internet name lookups.

    Since the WinGate server was a member of the Active Directory, and would automatically refer to the Active Directory DNS server when a DNS lookup was needed by the WinGate DNS service, you would have to manually tell WinGate not to use the Active Directory server for Internet name lookups in order to prevent the looping that would occur.

    The DNS Client in WinGate alleviates this extra configuration through probing. It will automatically determine if the DNS server is responsible for returning records for the domain it is located on, and if it is capable of providing Internet DNS resolution. If the DNS Client finds an Active Directory DNS server only capable of local lookups, then it will mark that DNS server appropriately and not refer to it for Internet DNS resolution. If WinGate is configured to be a Forwarder for the Active Directory DNS server, the WinGate DNS Service will still need to be installed to provide this capability.

    In the case where probing is switched off, you can manually configure a DNS server to be used for local lookups, and add these local domains in the Local domain pane of the DNS server properties (as explained in the steps above).

  1. no comments yet...

Download helpfile

You can use basic Full-Text Searches against the page title and body to find matching articles. Use the following search modifiers to refine your query:

  • event management (no quotes) will find all pages containing the words "event" OR "management"
  • "event management" (with quotes) will find all pages containing the phrase "event management"
  • +event -management will find all pages containing the word "event", AND NOT the word "management"