> Source: [sk183064](https://support.checkpoint.com/results/sk/sk183064)

# sk183064 - Traffic to an internal DNS server appears accepted in logs, but does not pass through Spark Firewall

| Property | Value |
|----------|-------|
| Solution ID | sk183064 |
| Date Created | 2025-03-12 |
| Last Modified | 2025-03-19 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R81.10.X |

## Symptoms

- * Traffic from an external network to an internal DNS server is accepted in the firewall logs but does not pass through a Quantum Spark Gateway, despite a configured NAT rule.

  Example Topology:

  \[DNS Server (Internal Network\] --- \[Quantum Spark Gateway\](WAN) --- \[External Network\]
* A kernel debug (`fw ctl zdebug +drop`) on the Quantum Spark Gateway shows one of these drops:

  * `fw_log_drop_ex: Packet proto=17 <External_Source_IP_Address>:<Port> -> <DNS_Server_NAT_IP_Address>:53 dropped by fw_handle_first_packet Reason: External DNS request;`

  * `fw_log_drop_ex: Packet proto=6 <External_Source_IP_Address>:<Port> -> <DNS_Server_NAT_IP_Address>:53 dropped by fw_handle_first_packet Reason: External DNS request;`

## Cause

By default, Quantum Spark Gateway drops DNS traffic in this specific case:

* The DNS traffic arrives at the WAN interface (from an external network).
* The traffic's destination is not the Quantum Spark Gateway.
* The DNS traffic does not arrive over a VPN tunnel.

Additionally:

* If UDP DNS traffic is dropped, the NAT rule is configured only for the DNS TCP traffic.
* If TCP DNS traffic is dropped, the NAT rule is configured only for the DNS UDP traffic.

## Solution

To resolve this issue, ensure that the NAT rule applies to both **UDP (DNS_UDP)** and **TCP (DNS_TCP)** traffic.

### For a Locally Managed Quantum Spark Gateway

1. In the WebUI, from the left navigation panel, click the **Access Policy** view.

2. In the **Firewall** section, click the **NAT** page.

3. In the applicable NAT rule, in the "**Original Services** " column, select the predefined **Service Group object "`DNS`"** that contains the "**`DNS_UDP`** " and "**`DNS_TCP`**" Service objects:

   |------------------------|--------------------------------|-------------------------------------------|-------------------|------------------------------------------------|--------------------|
   | Original Source        | Original Destination           | Original Service                          | Translated Source | Translated Destination                         | Translated Service |
   | External Source Object | NATed IP address of DNS Server | Predefined Service Group object "**DNS**" | =Original         | Internal IP address of DNS Server (static NAT) | =Original          |

### For a Centrally Managed Quantum Spark Gateway

1. In SmartConsole, from the left navigation panel, click **Security Policies**.

2. In the top panel, in the **Access Control** section, click **NAT**.

3. In the applicable NAT rule, in the column "**Original Services** ", select the predefined **Service Group object "`dns`"** which contains the "`domain-udp`" and "`domain-tcp`" service objects:

   |------------------------|--------------------------------|-------------------------------------------|-------------------|------------------------------------------------|---------------------|------------------|
   | Original Source        | Original Destination           | Original Services                         | Translated Source | Translated Destination                         | Translated Services | Install On       |
   | External Source Object | NATed IP address of DNS Server | Predefined Service Group object "**dns**" | =Original         | Internal IP address of DNS Server (static NAT) | =Original           | \*Policy Targets |

4. Install the Access Control policy.

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content