ZyXEL Communications VPN Series Handbook page 784

How to Configure Reputation Filter- DNS Filter
DNS Filter is a mechanism aimed at protecting users by intercepting DNS request
attempting to connect to known malicious or unwanted domains and returning a
false, or rather controlled IP address. The controlled IP address points to a sinkhole
server defined by the administrator.
Suppose of there a client who wants to access malicious domain. This will send query
to the DNS server for getting the domain name details. All of the traffic now here
gateway intercepts this query which is outgoing. Gateway contains DNS signatures
and identifies that this is bad site. What gateway can do here is send the redirect IP
address where we deploy a blocked page to the client. The client will connect to
redirect IP address instead of the real IP address of malicious domain, and get the
blocked page with the web access. This example will show you how to configure
DNS Filter to redirect web access after client hit the filter profile.
Figure. DNS Filter protects user from malicious websites
Note: All network IP addresses and subnet masks are used as examples in this article.
Please replace them with your actual network IP addresses and subnet masks. This example
was tested using ATP500 (Firmware Version: ZLD 4.60).
www.zyxel.com
784/810