Bypass OpenDNS filtering for Marketing Department

[magicrjm]

I have a network at xxx.xxx.xxx.160/27.

I have configured OpenDNS with my firewall’s IP Address of xxx.xxx.xxx.162/32. My Active Directory has been configured with the OpenDNS forwarders in the DNS server. The local LAN uses the internal DNS server for DNS requests.

In my Marketing department, I need them to bypass the OpenDNS filtering to get to websites like Twitter and Facebook. My thought was to have the private IP address of the Marketing Department computers leave the Firewall with an IP Address other than xxx.xxx.xxx.162 to bypass the filtering. I have set the firewall up for this. My LAN leaves the Firewall with the xxx.xxx.xxx.162 and my Marketing department leaves the Firewall with the public IP of xxx.xxx.xxx.174.

Since OpenDNS is only configured to filter xxx.xxx.xxx.162 I thought this would work. However it does not. Why? The other thing I noticed is that the Marketing department does not get the custom block page message I have setup in OpenDNS. I’ve tried flushing the DNS cache on the local computer and servers. I have also flushed the browser cache. Any ideas?

 

[cajuntank]

Have you defined the address the Marketing dep. uses coming out your firewall at OpenDNS and have different allowances for them? I know you can add networks to OpenDNS, and like you said, have each network at a /32 for 1 IP address. Each network would go under it's own "label" in which you could define different filtering levels. Although now that they are charging for some of the advanced stuff, that might be one of those particulars they charge for now... don't know that one.

I use OpenDNS myself and love it, but I use it only as a secondary/backup form of defense. I even have my firewall set to only allow DNS queries from my A.D. servers so that a user just can't change their DNS IP address on their machine and get Internet access (the ones that have access to change it that is ;-)

OpenDNS is great for that secondary coverage and or if that's all you can do, but it's not got that granularity of control like a internal filtering appliance would.

Hope I could help.