---
title: 'Tutorial: Secure DNS Traffic and Use DNS-Based Content Filtering'
canonical: https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--secure-dns-traffic-and-use-dns-based-content-filtering/
product: CloudConnexa Docs
description: Learn how to set up CloudConnexa DNS security and DNS-based content filtering with Cyber Shield — verify DNS traffic is routed through the WPC tunnel, configure Domain Filtering categories in a Shield Policy, and confirm malicious domains are blocked.
keywords: DNS security, DNS content filtering, Cyber Shield, domain filtering, malware blocking, Shield Policy
---

# Tutorial: Secure DNS Traffic and Use DNS-Based Content Filtering

## Overview

Use CloudConnexa to improve DNS security by sending DNS queries through the WPC tunnel and applying DNS-based content filtering with Cyber Shield Domain Filtering.

In this tutorial, you will:

1. Verify that a connected device sends DNS queries through CloudConnexa.
2. Configure Domain Filtering in a Shield Policy.
3. Test that CloudConnexa blocks a domain based on its content category.

You'll use `nslookup` to verify DNS resolution and `malware-test-domain.openvpn.com` to confirm that Domain Filtering blocks a malicious domain.

For an introduction to Domain Filtering and other Cyber Shield features, refer to [About Cyber Shield](https://openvpn.net/cloud-docs/owner/shield/about-cyber-shield.md).

## Before you begin

You need:

- A configured [CloudConnexa WPC](https://openvpn.net/cloud-docs/owner/get-started/start-using-cloudconnexa.md).
- A [User](https://openvpn.net/cloud-docs/owner/users/users---users/add-a-user.md) and [Device](https://openvpn.net/cloud-docs/owner/users/users---devices/add-a-device-for-a-user.md) configured to connect to the WPC.
- [OpenVPN Connect](https://openvpn.net/cloud-docs/owner/get-started/connect-to-your-wpc.md) installed on the test device.
- [DNS Proxy](https://openvpn.net/cloud-docs/owner/settings/settings---dns/set-cloudconnexa-dns-proxy-off.md) turned on for Domain Filtering.

> **Tip**
>
> Domain Filtering applies only to DNS queries resolved through CloudConnexa. If DNS Proxy is off, your Domain Filtering rules remain configured but aren't applied.
>
> Encrypted DNS, such as DNS over HTTPS (DoH), can send queries to a third-party resolver and bypass Domain Filtering. Turn off secure or encrypted DNS on the test device before testing Domain Filtering.

If you need to configure a User first, refer to [Add a User](https://openvpn.net/cloud-docs/owner/users/users---users/add-a-user.md).

## Step 1: Verify DNS resolution through CloudConnexa

First, connect the test device and verify that DNS queries are resolved through CloudConnexa.

1. Launch OpenVPN Connect.
2. Connect to your CloudConnexa WPC.
3. Open a command prompt or terminal.
4. Run an `nslookup` command for a domain. For example:

   ```
   nslookup openvpn.net
   ```
5. Review the DNS server **address** in the response.
   - When DNS resolves through CloudConnexa, the DNS server address is within the `100.96.0.0/11` range. For example:

     ```
     Server:  UnKnown
     Address:  100.96.2.65
     ```

     > **Tip**
     >
     > `Server` may display `UnKnown` if the DNS server IP address doesn't resolve to a hostname. This doesn't indicate a DNS resolution problem.

   > **Note**
   >
   > The specific DNS server IP can vary. Verify that the address belongs to `100.96.0.0/11` rather than looking for a specific IP address.

If the DNS server isn't in the CloudConnexa range, verify the device's DNS configuration and that DNS Proxy is on before continuing.

For a more detailed DNS-only workflow, refer to [Tutorial: Use CloudConnexa to Secure DNS Traffic](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--use-cloudconnexa-to-secure-dns-traffic.md).

## Step 2: Configure DNS-based content filtering

Cyber Shield Domain Filtering lets you monitor or block DNS requests based on content categories.

Domain Filtering is configured per Shield Policy. The policy assigned to a User Group determines which Domain Filtering settings apply to its users.

If you haven't created custom Shield Policies, configure the Default Policy to apply filtering to User Groups that aren't assigned another policy.

1. Sign in to the CloudConnexa Administration Portal using your WPC's **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Select **Shield → Policies**.
3. Select the edit icon for the Shield Policy you want to configure.
4. Select the **Domain Filtering** tab.
5. Turn on Domain Filtering.
6. Select a protection level or configure individual content categories.
7. Ensure the **Malware** category is set to Blocked in your selected protection level or custom category configuration.
8. If appropriate for your filtering requirements, configure other categories such as **Hacking**.
9. Save your changes.
   - The Domain Filtering settings now apply to User Groups covered by that Shield Policy.

For information about assigning different filtering settings to different User Groups, refer to [About Shield Policies](https://openvpn.net/cloud-docs/owner/shield/shield---policies/about-shield-policies.md) and [Create or Edit a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/create-or-edit-a-shield-policy.md).

For the available protection levels and content categories, refer to [Domain Filtering Protection Levels and Content Categories](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/domain-filtering-protection-levels-and-content-categories.md).

## Step 3: Verify that Domain Filtering blocks a malicious domain

Use the OpenVPN test domain to verify that the policy blocks a domain categorized as Malware.

1. Verify that the test device is connected to CloudConnexa.
2. Verify that the User Group for your test user uses the Shield Policy you configured.
3. Open a web browser on the test device.
4. Navigate to: `malware-test-domain.openvpn.com`.
5. Verify that access is blocked.

   > **Tip**
   >
   > Depending on the browser, you may see an error such as: "This site can't be reached."

The blocked test confirms that the device's DNS query was evaluated by the Shield Policy's Domain Filtering configuration.

If the domain isn't blocked:

1. Verify that **Malware** is blocked in the policy's **Domain Filtering** tab.
2. Verify that the test user's User Group uses the expected Shield Policy.
3. Verify that **DNS Proxy** is on.
4. Use `nslookup` again to verify that DNS resolves through the CloudConnexa `100.96.0.0/11` range.
5. Verify that secure or encrypted DNS, including DoH, isn't enabled on the test device or browser.

## What happens next

Your connected users can now send DNS queries through CloudConnexa and receive DNS-based content filtering according to their Shield Policy.

You can create additional Shield Policies when different User Groups require different filtering. You can also:

- Use the **Domain Allow List** to allow specific domains that would otherwise be blocked.
- Use the **Domain Block List** to block specific domains regardless of their content category.
- Review Domain Filtering events from **Shield → Overview** and **Shield → Metrics**.

## Related resources

- [About Cyber Shield](https://openvpn.net/cloud-docs/owner/shield/about-cyber-shield.md)
- [About Shield Policies](https://openvpn.net/cloud-docs/owner/shield/shield---policies/about-shield-policies.md)
- [Create or Edit a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/create-or-edit-a-shield-policy.md)
- [Assign User Groups to a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/assign-user-groups-to-a-shield-policy.md)
- [Domain Filtering Protection Levels and Content Categories](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/domain-filtering-protection-levels-and-content-categories.md)
- [Configure Domain Filtering for a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/configure-domain-filtering-for-a-shield-policy.md)
- [About DNS Settings](https://openvpn.net/cloud-docs/owner/settings/settings---dns/about-dns-settings.md)
- [Tutorial: Use CloudConnexa to Secure DNS Traffic](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--use-cloudconnexa-to-secure-dns-traffic.md)

---

Prev: [Tutorial: Use CloudConnexa to Secure DNS Traffic](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--use-cloudconnexa-to-secure-dns-traffic.md)
Next: [Tutorial: Protect Your Users From Malware and Other Cyber Threats](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--protect-your-users-from-malware-and-other-cyber-threats.md)
Index: https://openvpn.net/cloud-docs/llms.txt