防火牆擋到哪個網域？從被阻擋 IP 反查 FQDN 的跨廠牌做法

時間=<含時區> 來源IP=<client> 目的IP=<blocked-ip> 協定=<tcp/udp> 目的Port=<port> 規則=<rule/policy-id> 動作=<drop/reset/block>

Get-Date -Format o

date --iso-8601=seconds

Resolve-DnsName -Name 203.0.113.50 -Type PTR -ErrorAction SilentlyContinue

dig +short -x 203.0.113.50

Resolve-DnsName candidate.example -Type A; Resolve-DnsName candidate.example -Type AAAA

dig +short A candidate.example; dig +short AAAA candidate.example

openssl s_client -connect 203.0.113.50:443 -servername candidate.example -brief </dev/null

tcpdump -ni <LAN介面> 'host 192.168.10.25 and port 53' -c 200 -w blocked-dns.pcap

dns.a == 203.0.113.50

dns.aaaa == 2001:db8::50

ip.dst == 203.0.113.50 && tls.handshake.extensions_server_name

Monitor > Logs > Traffic：套用 (addr.src in 192.168.10.25) and (addr.dst in 203.0.113.50) and (action neq allow)

Monitor > Logs > URL Filtering：套用 (addr.dst in 203.0.113.50)

Monitor > Logs > DNS Security 或 Threat：以來源 IP 與事件時間縮小

show dns-proxy fqdn all

show dns-proxy fqdn name candidate.example

show dns-proxy cache filter FQDN candidate.example type RR_A all

Traffic Session ID=<id> ↔ URL Filtering Session ID=<id>

Log & Report > Forward Traffic：Destination = 203.0.113.50，並加 Source、時間、Action 篩選

在詳細 log 搜尋：hostname、dstname、url、policyid、sessionid、utmaction

diagnose firewall fqdn list-ip

diagnose firewall fqdn get-ip <FQDN_address_object_name>

diagnose test application dnsproxy 6

diagnose test application dnsproxy 7

diagnose test application dnsproxy 13

Log & Report > Security Events > DNS Query：Source = 192.168.10.25，時間貼近阻擋事件

Log viewer > Firewall：Destination IP = 203.0.113.50，再加 Source IP、時間與 Action

Log viewer > Web filter：用 Source IP、Destination IP 與同一時間窗篩選

Log viewer > Timer filter > Add filter > Export logs

/sbin/ipset -L hostset | grep -E 'HOSTID=.*TYPE=(fqdn|wcfqdn)' | head -n 20

TARGET_IP='203.0.113.50'
/sbin/ipset -L hostset |
awk -v ip="$TARGET_IP" '
/HOSTID=[0-9]+,TYPE=(wc)?fqdn/ {
  match($0,/HOSTID=[0-9]+/); id=substr($0,RSTART+7,RLENGTH-7)
  match($0,/TYPE=[^, ]+/); type=substr($0,RSTART+5,RLENGTH-5)
  next
}
$1==ip && id!="" {print id, type}
' | sort -u

psql -U nobody -d corporate -c "SELECT hostid,hostname,netid,hosttype FROM tblhost WHERE hostid=714;"

TARGET_IP='203.0.113.50'
/sbin/ipset -L hostset | awk -v ip="$TARGET_IP" '
/HOSTID=[0-9]+,TYPE=(wc)?fqdn/ {
  match($0,/HOSTID=[0-9]+/); id=substr($0,RSTART+7,RLENGTH-7)
  match($0,/TYPE=[^, ]+/); type=substr($0,RSTART+5,RLENGTH-5); next
}
$1==ip && id!="" {print id, type}
' | sort -u | while read HOST_ID HOST_TYPE; do
  case "$HOST_ID" in ''|*[!0-9]*) continue ;; esac
  printf '\nRuntime match: hostid=%s type=%s\n' "$HOST_ID" "$HOST_TYPE"
  psql -U nobody -d corporate -c "SELECT hostid,hostname,netid,hosttype FROM tblhost WHERE hostid=${HOST_ID};"
done

/sbin/ipset test hostset fqdn,714,0,203.0.113.50

psql -U nobody -d corporate -c "SELECT fwruleid,hostid FROM tblfwdest WHERE hostid=714;"

grep -F 'candidate.example' /log/fqdnd.log /log/dnsgrabber.log /log/webproxy.log 2>/dev/null

action:Drop destination:203.0.113.50

source:192.168.10.25 destination:203.0.113.50

203.0.113.50

blade:"Application Control" OR blade:"URL Filtering"

Security Policies > Access Control：搜尋目的 IP、物件名稱或 .candidate.example

tcpdump -ni any 'host 192.168.10.25 and port 53' -c 100 -w /var/log/fqdn-check.pcap

Analysis > Connections > Events：篩選 Source IP、Destination IP、時間與 Action

URL=<若有>；DNS Query=<若有>；Destination IP=203.0.113.50

show dns

show dns host candidate.example

show fqdn ip 203.0.113.50

show fqdn

Status > System Logs > Firewall：篩選 Destination 203.0.113.50

pfctl -vvsr | grep 1000000103

Diagnostics > Tables > 選擇規則使用的 alias > 搜尋 203.0.113.50

pfctl -t <alias_name> -T show | grep -F '203.0.113.50'

Status > System Logs > System/DNS Resolver

Status > System Logs > Firewall > IP 旁的資訊圖示

Diagnostics > Packet Capture：Interface=LAN、Host Address=192.168.10.25、Port=53、Count=200

Firewall > Log Files > Live View：dst=203.0.113.50，加 src、action、label 與時間

Firewall > Log Files > Live View > 點 rid／info

Firewall > Diagnostics > Aliases > Find references：203.0.113.50

pfctl -t <alias_name> -T show | grep -F '203.0.113.50'

Services > Unbound DNS > Log File：以來源 IP、名稱與事件時間搜尋

Services > Unbound DNS > Advanced：Log Replies + Tag Queries and Replies

drill -b <firewall-source-ip> candidate.example A

Interfaces > Diagnostics > Packet Capture：Host=192.168.10.25、Port=53、Count=200

/log print where topics~"firewall"

/ip firewall filter print detail where log=yes

/ip dns print

/ip dns cache all print where data="203.0.113.50"

/ip dns cache all print where name~"candidate.example"

/ip firewall filter print detail where tls-host!=""

/system logging print where topics~"firewall"

Security & SD-WAN > Appliance status > Tools > Firewall Logging

Network-wide > Monitor > Event log > Event type: Layer 7 firewall rule

Security & SD-WAN > Monitor > Security Center

Network-wide > Configure > General > Syslog：啟用 Appliance Flows，並在 Firewall 規則勾 Syslog

Syslog roles：啟用 Appliance URLs

Interface=LAN；Filter=host 192.168.10.25 and port 53

Security & SD-WAN > Configure > Firewall：確認命中規則、FQDN／domain 與用戶端 DNS 路徑

Insights > Flows：篩選 Source、Destination 203.0.113.50、Port、Action 與時間

Insights > Flows > Export

System Log > Security Detection 或 Insights > Inspection

Settings > Policy Engine／Zone-Based Firewall：檢查命中政策的 App、Domain (Web)、Region 與 Action

Settings > CyberSecure > Content Filter：檢查 policy、source network／device、allowlist 與 blocklist

tail -f /var/log/dnsmasq.log

grep -F '203.0.113.50' /var/log/suricata/suricata.log

Settings > CyberSecure > Traffic Logging > NetFlow (IPFIX)