Accessing external site over DNS fails, acess through IP address works with a cisco asa

Question

​My lab network topology with an asa firewall is as follows

10.10.10.20 --> ASA ---> 192.168.1.10 --> external website

I want a client with the ip address 10.10.10.20 to access external websites so i set up nat

nat (inside,outside) static 192.168.1.10

and access list

access-list outside-acl extended permit tcp any host 10.10.10.20 eq www 
access-list outside-acl extended permit tcp any host 10.10.10.20 eq domain 

access-list inside-acl extended permit tcp 10.10.10.0 255.255.255.0 any eq www 
access-list inside-acl extended permit tcp 10.10.10.0 255.255.255.0 any eq domain

access-group outside-acl in interface outside
access-group inside-acl in interface inside

when I access a website with its domain name it can't access it but I access website with ip address it works - how do I fix this?

Answer 1

Based on the guidelines you have provided, you do not need the outside-acl ruleset. Just use these on the inside.

I am making the assumption that your DNS is located on the 192.168.1.0/24 side. Note that without more information, it's difficult to lock down DNS rulesets so I opened them as 53/udp to all addresses. DNS resolvers iteratively query different authoritative hosts until they find the correct DNS server, so just leave DNS open for now.

access-list inside-acl extended permit tcp 10.10.10.0 255.255.255.0 any eq www 
! I am assuming your DNS is somewhere on the 10.10.10.x side
access-list inside-acl extended permit tcp 10.10.10.0 255.255.255.0 any eq domain
access-list inside-acl extended permit udp 10.10.10.0 255.255.255.0 any eq domain

access-group inside-acl in interface inside

As far as your nat statement, the syntax you included isn't correct, but I'm assuming you did something like this

static (inside,outside) 192.168.1.10 10.10.10.0 netmask 255.255.255.0