FQDN Allow / Block Policy

Navigation: Scenarios → FQDN Policy

Control outbound access using fully qualified domain names (FQDNs) instead of static IPs. The firewall resolves each FQDN to IP addresses and refreshes the resolved list every 60 seconds, so policies stay correct when cloud services change IPs.

Important: TOORCE accepts literal FQDN hostnames only. Wildcards (*.example.com) and regular expressions are not allowed as FQDN entries.

Network design

LAN users send traffic through the firewall. Rules match destination FQDN address objects. The firewall DNS engine re-resolves those names on a 60-second interval and updates the active policy IP set automatically.

Figure 1 — FQDN resolution, 60-second refresh, allow and deny rules

How FQDN policy works

1. Admin creates Address Object (type FQDN) → e.g. www.microsoft.com
2. Firewall resolves FQDN via System DNS → 20.190.x.x, 40.126.x.x, ...
3. Every 60 seconds → re-resolve and update IP list in kernel/policy
4. Inline rule references FQDN object → Allow or Deny matched traffic
5. IP changes at provider → next refresh picks up new addresses (no rule edit)

Prerequisites

• LAN and WAN interfaces configured (NAT Gateway or equivalent internet access)
• System DNS configured on the firewall (required for FQDN resolution)
• Outbound DNS (UDP/TCP 53) allowed for the firewall itself

Step 1 — Configure system DNS on the firewall

FQDN objects cannot resolve without a working DNS resolver on the appliance.

1. Go to System Settings → General → General tab.
2. Click Edit and set:

3. Click Save.

The firewall uses this DNS server to resolve all FQDN address objects every 60 seconds.

Step 2 — Create FQDN address objects (allowed destinations)

1. Go to Aliases & Objects → Address.
2. Click + Add New.
3. Create objects for each allowed hostname — one FQDN per object (or one object with multiple literal FQDNs, one per line):

4. Click + Create Record.

Allowed FQDN format rules

Each entry must be a complete, resolvable hostname. The firewall validates the format and rejects wildcards and regular expressions.

Step 3 — Create FQDN address objects (blocked destinations)

Create separate objects for destinations you want to deny:

For multiple blocked sites, create one object per FQDN or group related FQDNs in a single FQDN list object (still literal names only, no wildcards).

Step 4 — Create allow rule (FQDN destinations)

Allow LAN users to reach approved FQDNs only.

1. Go to Rules & Policies → Inline Rules → + Add New.

General

Interfaces

Source

Destination

The rule matches traffic to current resolved IPs of those FQDNs. When Microsoft changes CDN addresses, the firewall picks up new IPs on the next 60-second refresh.

3. Click + Create Record.

Step 5 — Create deny rules (block FQDN destinations)

Place deny FQDN rules above the general allow rule.

1. Click + Add New.

2. Click + Create Record.
3. Click Install Policy.

Step 6 — Verify FQDN resolution and 60-second refresh

Monitor results in Logs & Events → Firewall Security — policy name shows Allow_Approved_FQDN or Deny_Blocked_FQDN.

Recommended rule order

This implements a default-deny internet policy where only approved FQDNs are reachable.

FQDN vs static IP — when to use each

Design notes

• 60-second refresh — rules always use the latest DNS answer; allow up to 60s delay after a provider IP change.
• DNS dependency — if System DNS fails, FQDN objects may not resolve and rules will not match as expected.
• One name = one hostname — use separate objects for www.example.com and api.example.com if both are needed.
• No wildcards — to allow all subdomains you must add each FQDN explicitly (e.g. mail.example.com, api.example.com, cdn.example.com).
• HTTPS SNI — FQDN policy works at Layer 3/4 on resolved IPs; for full URL filtering use Web Security profiles.

Related topics

• Address Objects — FQDN type
• Inline Rules
• System Settings — DNS
• Firewall Security Logs
• Web Security — URL/category filtering
• All Scenarios