I'm setting up a public WiFi network using Meraki access points in NAT mode, and I want to ensure that users can access an internal web server. Previously, I used a Custom DNS setting for the SSID, along with a traffic shaping rule to allow TCP traffic to the server's address. However, I've now implemented Cisco Umbrella DNS layer protection for content filtering, but it seems this disables the Custom DNS option in the access control settings. I've read that DNS exclusions can be configured, but that option is only available in bridge mode, which I prefer to avoid. Is there any way to keep Cisco Umbrella's DNS protection enabled while also using a custom DNS for name resolution or creating a DNS exception while still operating in Meraki's NAT mode?
4 Answers
You might want to check if Umbrella has any custom DNS options in their portal. They might have a way to configure it that could work for you.
Consider setting up a group policy and linking it to Umbrella from Meraki. This configuration allows all DNS requests to go through Umbrella before getting out. It was simple for me at my previous job. Alternatively, if you switch to bridge mode and only permit DNS requests through the firewall for that particular SSID, you can block everything else.
I faced the same issue, so I decided to switch to bridge mode. I created a separate VLAN just for the device and enabled client isolation on the Meraki AP. This way, devices only connect to the internet without interaction between them or with our internal network.
You can actually configure Umbrella to exclude certain domains from filtering. Just go to Firewall & traffic shaping in your SSID settings where you enable the integration. You should find a section to enter the domains you want to exclude. Here's a helpful link to the documentation: [Integration Instructions](https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Operate_and_Maintain/How-Tos/Manually_Integrating_Cisco_Umbrella_and_Secure_Access_with_Meraki_Networks).
I checked that documentation earlier, but it only shows the exclusion option for bridge mode. I really want to keep NAT mode if I can.