3.6 DNS Filtering & Botnet C&C Protection

3.6 DNS Filtering & Botnet C&C Protection

DNS Filtering provides early-stage security enforcement by inspecting and filtering Domain Name System (DNS) lookups before an IP connection is established. Combined with Botnet Command & Control (C&C) protection and DNS Sinkhole capabilities, FortiOS 7.6 prevents infected internal endpoints from communicating with malicious infrastructure.

---

DNS Filtering Architecture

DNS Filtering operates on DNS traffic passing through the FortiGate (UDP/TCP port 53, as well as DNS-over-HTTPS [DoH] and DNS-over-TLS [DoT] when decrypted).

Early-Stage Protection Advantage

When a client attempts to visit a website or initiate malware communication, it first issues a DNS query to resolve the destination domain name (e.g., malicious-domain.com) to an IP address.

• Traditional Web Filtering: Inspects the HTTP/HTTPS request after TCP connection establishment and SSL handshakes complete.
• DNS Filtering: Inspects the initial DNS query. If the domain is rated as malicious, FortiGate blocks or redirects the DNS response. The client never receives the real malicious IP address, preventing the establishment of the underlying TCP/IP connection entirely.

---

Domain Filtering & External Threat Feeds

DNS Filter profiles (config dnsfilter profile) enforce domain security using three lookup mechanisms:

1. FortiGuard DNS Category Filtering: Categorizes domains into standard risk groups (Security Risks, Phishing, Malicious, Adult, etc.).
2. Local Domain Filters: User-defined domain block/allow lists utilizing Simple, Wildcard, or Regex domain matching.
3. External Resource Threat Feeds: Dynamically imports external domain blocklists (plain text lists or STIX/TAXII threat feeds) hosted on external HTTP/HTTPS servers. FortiGate automatically refreshes these feeds at configured intervals.

---

Botnet Command & Control (C&C) Protection

Malware botnets rely on Command & Control (C&C) servers to receive operational instructions, exfiltrate stolen data, or download secondary payloads. Fortinet guards against botnet activity using two dynamic databases:

• Botnet Domain Database: Contains domain names associated with active botnet C&C servers.
• Botnet IP Database: Contains known IP addresses of active botnet infrastructure.

When a host inside the network attempts to resolve or connect to a botnet C&C destination, FortiGate intercepts and blocks the traffic.

---

DNS Sinkhole IP Mechanism

The DNS Sinkhole feature is one of the most powerful diagnostic and mitigation tools in FortiOS security administration.

Operational Steps of DNS Sinkhole

1. Infected host sends DNS Query: c2-server.evil.com
2. FortiGate DNS Filter matches domain to Botnet / Malicious Category.
3. FortiGate intercepts DNS response and replaces real malicious IP with configured Sinkhole IP (e.g., 192.0.2.1).
4. Infected host receives Sinkhole IP and attempts connection to 192.0.2.1.
5. FortiGate blocks connection attempt and generates security log event.

Operational Advantages of DNS Sinkhole

1. Prevents Malicious Communication: The infected endpoint receives the fake sinkhole IP address (e.g., 192.0.2.1 or loopback 127.0.0.1) instead of the real C&C server IP, rendering malware communication inert.
2. Pinpoints Infected Hosts: When the infected host attempts to establish a connection to the sinkhole IP, FortiGate logs the connection attempt. Security Operations Center (SOC) teams can filter logs for destination 192.0.2.1 to immediately identify the exact internal IP address of the compromised host.

---

Overview Comparison

---

CLI Configuration Examples

Configuring a DNS Filter Profile with Category Blocking and Sinkhole

config dnsfilter profile
    edit "Corporate_DNS_Filter"
        set comment "Block malicious categories and enable botnet sinkhole"
        config ftgd-dns
            config filters
                edit 1
                    set category 26
                    set action block
                next
                edit 2
                    set category 61
                    set action block
                next
            end
        end
        set block-action redirect
        set redirect-portal 192.0.2.1
        set log-all-domain enable
    next
end

Configuring External Resource Threat Feed for Custom Domain Blocklist

config system external-resource
    edit "Threat_Feed_Domains"
        set type domain
        set resource "https://security-server.example.com/threats/domains.txt"
        set refresh-rate 60
    next
end

Enabling Botnet C&C Database Connections on FortiGate Interface

config system fortiguard
    set botnet-ip-update enable
end

config ips global
    set database extended
end