How does the FQDN Wildcard work?

Last modified on 8 Feb, 2022. Revision 7
How does the FQDN Wildcard work?
Up to date for
14.00.00
Supported since
12.00.10
Status OK

Question:
I have applied a FQDN-Object with a wildcard as destination net in one of my IP-Policys. But currently the traffic wont match the rule and the traffic is dropped. If i remove the wildcard and input the whole FQDN-address everything works. Something must be wrong with the firewall.

Answer:
First we must go through how the FQDN Wildcard works in cOS Core.
To get the wildcards to work it needs a DNS-Profile applied to the DNS-policy, read more about this in the cOS Core Admin Guide, example for version 14.00.00 section 6.1.12. DNS ALG, page 640 and on page 193.

As the FQDN-objects with wildcard relies on DNS to work, there are some scenarios when the objects wont update with the correct address and the traffic will be blocked.

The FQDN Wildcard object is updated when a DNS query is made from the client, and if it matches the FQDN-object the IP will be added to the cache for that object on the firewall.
If the IP is already in the cache of the client, no DNS query will be made and the firewalls cache will remain empty as the Firewall will not receive any DNS queries from the client. This resulting in that policies/objects wont function properly as the Firewall lacks details about the resolved DNS entry.

This problem could be solved by flushing the clients DNS cache or use another client without this FQDN resolved. Another solution would be to have your own DNS server with a low TTL, so that you won’t end up in a situation where the clients have the resolved FQDN but it’s not present in the Firewall.

Related articles

cOS Core 14.00 FAQ
27 Apr, 2022 arm x86 core
Configuring public certificates in NetWall firewalls
23 Aug, 2022 core certificate oneconnect ipsec vpn
Configure the Android OpenConnect client towards Clavister NetWall
23 Aug, 2022 sslvpn openconnect oneconnect android core
Using PCAP packet capture in cOS Core
7 Sep, 2022 core cli pcap netwall pcapdump
Problem with auto-created Core routes
22 Mar, 2021 core ipsec routing
A trusted webpage blocked by IP reputation
22 Jan, 2021 core ipreputation
Could not open outbound connection?
9 Mar, 2021 core ping connections
Configure Linux OpenConnect towards Clavister NetWall
5 Mar, 2021 sslvpn openconnect oneconnect linux core
Configuring SSL-VPN / OneConnect server on secondary Firewall IP address
8 Apr, 2021 core sslvpn oneconnect interfaces arp
Using /31 network masks in cOS Core (RFC-3021)
1 Jun, 2022 core routing management
Device initiated InControl management of NetWall HA clusters with a single public IP
31 Mar, 2022 incontrol core netcon netwall ha cluster coscore
How to configure a Captive Portal in cOS Core
25 May, 2022 howto core authenticator authentication webauth captive
Using Multicast DNS with cOS Core
24 May, 2021 core howto mdns multicast transparentmode airprint igmp dns
IPsec license usage calculation
14 Apr, 2021 core license ipsec
Does IPsecBeforeRules trigger before Access rules?
8 Sep, 2020 core ipsec rules access
Clavister SFP/SFP+ module compatibility
11 Apr, 2021 core sfp gbic hardware
Using Stateless Policies in cOS Core
16 Jun, 2021 core stateless rules netwall
Why some log category ID's are missing
23 May, 2022 core log logreceiver
NetWall virtual firewall creation under KVM on ARM
20 May, 2021 kvm core arm coscore netwall
Allowing Traceroute to and through cOS Core
23 Aug, 2022 core behaviour icmp ping traceroute
The meaning of the "Default_Access_Rule" log entry
25 Jan, 2021 brokenlink core arp log routing
How to setup a simple cloud-init environment for testing
30 Nov, 2020 howto core cloud-init dhcp
Protecting against the Apache Log4j exploit
15 Dec, 2021 core idp ipreputation log4j
What is a "zombie" connection?
24 Mar, 2021 core connections
Managing NetWall HA clusters over the Internet using one public IP
21 Jun, 2022 core ha hacluster netwall coscore slb
Assigning additional IPs to cOS Core Ethernet interfaces
7 May, 2021 core ethernet vlan arp garp
Allowing Path MTU discovery in cOS Core
9 Jul, 2021 core mtu netwall mtudiscovery
Freeing up more memory in the Firewall
23 Aug, 2022 core connections ipsec memory
Is Statless (FwdFast) faster than a normal IP policy?
27 Jan, 2021 core stateless routing brokenlink
Configure the OpenConnect-GUI client towards Clavister NetWall
23 Aug, 2022 sslvpn openconnect oneconnect macos windows linux core