Back to Details

twingate-dns-security

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Role

职责

This skill owns Twingate's Internet Security product area: DNS filtering, exit networks, DNS-over-HTTPS, and browser security. It covers DNS Security Profile design, priority ordering, group-based policy assignment, exit network egress patterns, and the licensing boundary between Internet Security and Private Access. It is the authority on when to use DNS filtering versus exit networks versus resource-level access policy.
此技能负责Twingate的互联网安全产品领域：DNS过滤、出口网络、DNS-over-HTTPS及浏览器安全。涵盖DNS安全配置文件设计、优先级排序、基于组的策略分配、出口网络出口模式，以及互联网安全与私有访问之间的许可边界。它是判断何时使用DNS过滤、出口网络还是资源级访问策略的权威依据。

Decisions & Guidelines

决策与指南

  • Confirm Internet Security entitlement before designing any solution around DNS filtering or exit networks. Internet Security is a separate product area and may require a different license tier. If the customer doesn't have entitlement, DNS Security Profiles and exit network configuration won't appear in the admin console.
  • Exit networks route traffic to a fixed egress point — they do not block destinations. If the goal is to prevent access to a website, use DNS filtering. If the goal is to ensure traffic exits from a fixed IP, use an exit network. These are not substitutes.
  • Priority is numeric, and lower number = higher priority. This is the most commonly confused aspect of DNS Security Profile assignment. A permissive Engineering profile at priority 1 beats a restrictive Corporate profile at priority 2, even when the user is in both groups.
  • Always configure the "Everyone" group as a baseline with the high-confidence threat categories blocked at minimum. Users not in any group with a profile receive no filtering at all. "Everyone" is the safety net. Current category names and recommended baseline categories are in 
    references/dns-security-overview.md
    and 
    references/dns-filtering.md
    .
  • Enable STRICT fallback mode only after pre-populating the allow list with the customer's known-good domains. STRICT mode (deny-by-default) will block legitimate SaaS tools until they are explicitly allowed. Always roll out STRICT to a pilot group first.
  • DNS-over-HTTPS in Twingate covers only DNS queries that flow through the Twingate Client. It does not encrypt OS-level DNS for non-Twingate traffic or queries made before the Client starts. If full-device DoH is required, configure it at the OS or network level in addition to Twingate.
  • A "DNS conflict" symptom is usually a CGNAT range collision or a competing DNS-modifying tool, not a Twingate misconfiguration. Twingate claims the entire 
    100.96/12
    range and acts as a transparent DNS proxy on only one interface (the default gateway's). Before redesigning a DNS Security Profile, rule out a third-party DNS filter/AV product or a multi-NIC environment — the help-center corpus documents the specific known conflicts and their workarounds.
  • 在围绕DNS过滤或出口网络设计任何解决方案之前，先确认互联网安全权限。 互联网安全是一个独立的产品领域，可能需要不同的许可层级。如果客户没有权限，DNS安全配置文件和出口网络配置将不会出现在管理控制台中。
  • 出口网络将流量路由到固定出口点——它们不会阻止目标地址。 如果目标是阻止访问某网站，请使用DNS过滤。如果目标是确保流量从固定IP出口，请使用出口网络。二者不可相互替代。
  • 优先级为数值型，数值越小优先级越高。 这是DNS安全配置文件分配中最容易混淆的点。优先级为1的宽松型工程配置文件会覆盖优先级为2的严格型企业配置文件，即使用户同时属于两个组。
  • 始终将“所有人”组配置为基线，至少拦截高可信度威胁类别。 不属于任何带配置文件组的用户将不会受到任何过滤。“所有人”组是安全保障网。当前的类别名称及推荐基线类别位于
    references/dns-security-overview.md
    和
    references/dns-filtering.md
    中。
  • 仅在预填充客户已知可信域名的允许列表后，才启用STRICT回退模式。 STRICT模式（默认拒绝）会阻止合法的SaaS工具，除非明确允许它们。始终先向试点群组推出STRICT模式。
  • Twingate中的DNS-over-HTTPS仅涵盖流经Twingate客户端的DNS查询。 它不会对非Twingate流量或客户端启动前的查询进行操作系统级DNS加密。如果需要全设备DoH，除了Twingate外，还需在操作系统或网络层面进行配置。
  • “DNS冲突”症状通常是CGNAT范围冲突或竞争型DNS修改工具导致的，而非Twingate配置错误。 Twingate占用整个
    100.96/12
    范围，且仅在一个接口（默认网关的接口）上充当透明DNS代理。在重新设计DNS安全配置文件之前，先排除第三方DNS过滤器/杀毒软件或多NIC环境的问题——帮助中心文档记录了具体的已知冲突及其解决方法。

Search References First

优先搜索参考资料

Grep 
references/
with the user's own keywords or exact error text before answering. Vendor names, CGNAT ranges, and exact log lines live in the file bodies, not the filenames:
grep -ril "all nameservers have failed" references/   # -> 9539322912-twingate-linux-client-fails-to-start-logs-show-dns-errors.md
grep -ril "100.96/12" references/                     # -> 4359531030-cgnat-ip-conflicts-...md
grep -ril "avast" references/                         # -> 6928700605-dns-avast-real-site-protection.md
If the user reports an exact error message or names a third-party product, grep for it before theorizing about causes. Never answer from training-data memory for: DNS filtering category names, third-party DNS/AV product conflicts, exit-network configuration steps, or DNS Security Profile schema and priority mechanics — the category list and third-party integration behavior change and are documented per-vendor in 
references/
. Filenames reveal only the topic — vendor names, tool names, and exact error strings live in the bodies. This skill also owns 
gh-*
community repos (DIY VPN, Ubiquiti headless gateway); if the user asks whether tooling or a reference build exists for X, grep before saying no.
回答前先用用户的关键词或精确错误文本在
references/
中执行grep搜索。 供应商名称、CGNAT范围和精确日志行存在于文件内容中，而非文件名中：
grep -ril "all nameservers have failed" references/   # -> 9539322912-twingate-linux-client-fails-to-start-logs-show-dns-errors.md
grep -ril "100.96/12" references/                     # -> 4359531030-cgnat-ip-conflicts-...md
grep -ril "avast" references/                         # -> 6928700605-dns-avast-real-site-protection.md
如果用户报告了精确错误信息或提及第三方产品，先搜索再推测原因。 对于以下内容，绝不要仅凭训练数据记忆回答：DNS过滤类别名称、第三方DNS/杀毒软件产品冲突、出口网络配置步骤，或DNS安全配置文件架构和优先级机制——类别列表和第三方集成行为会发生变化，且在
references/
中按供应商记录。文件名仅揭示主题——供应商名称、工具名称和精确错误字符串存在于内容中。此技能还负责
gh-*
社区仓库（自制VPN、Ubiquiti无头网关）；如果用户询问是否存在针对X的工具或参考构建，请先搜索再回答没有。

Routing

路由

Co-activate, don't either/or. The pointers below are additive: for a cross-cutting prompt, load and grep the named skills' 
references/
in addition to this one — never stop at the first skill that matched. Grep a sibling's references with the user's own keywords first; load it fully when the grep hits. Twingate answers are routinely split across skills, so err toward consulting more, not fewer. Common cross-cutting clusters here: profile-to-group mapping → identity; split-DNS interception model → architect; filtering breaking access → troubleshoot.
  • → twingate-identity: DNS Security Profiles attach to Groups; for group management, SCIM provisioning, or understanding how group membership determines which profile applies
  • → twingate-architect: for split DNS model questions — understanding which DNS queries Twingate intercepts before configuring Internet Security
  • → twingate-troubleshoot: when DNS filtering appears to be interfering with private resource access or general connectivity, or the symptom is a client-side bug rather than a DNS Security Profile design question
协同激活，而非二选一。 以下指引是附加性的：对于跨领域的请求，除了加载此技能的
references/
并进行grep搜索外，还需加载指定技能的
references/
并搜索——绝不能在匹配到第一个技能时就停止。先用用户的关键词搜索同级技能的参考资料；当搜索命中时，再完整加载该技能。Twingate的解决方案通常分散在多个技能中，因此应倾向于咨询更多技能，而非更少。此处常见的跨领域集群：配置文件到组的映射 → 身份；拆分DNS拦截模型 → 架构师；过滤导致访问中断 → 故障排查。
  • → twingate-identity：DNS安全配置文件附加到组；如需组管理、SCIM配置或了解组成员身份如何决定应用哪个配置文件
  • → twingate-architect：关于拆分DNS模型的问题——在配置互联网安全之前，了解Twingate会拦截哪些DNS查询
  • → twingate-troubleshoot：当DNS过滤似乎干扰私有资源访问或通用连接时，或症状是客户端漏洞而非DNS安全配置文件设计问题时

References

参考资料

See 
references/
 for the current corpus, refreshed weekly. Three kinds of file live there:
  • {slug}.md
     — summaries of 
    twingate.com/docs
    pages (product documentation).
  • {numeric-id}-{slug}.md
     — Twingate help-center articles: symptom-shaped DNS conflict reports, exact error strings, and per-platform gotchas.
  • gh-{org}-{repo}.md
     — summaries of public Twingate GitHub repos: community exit-network deployment tooling.
If the user asks about…Read first
DNS Security overview, profile design, exit-node config, DoH enforcement
dns-security-overview.md
, 
dns-security.md
DNS filtering categories, allow/block lists, profile priority
dns-filtering.md
Internet Security product scope, licensing, client config
internet-security.md
, 
internet-security-client-configuration.md
Exit networks (egress IPs, configuration, AWS-specific patterns)
exit-networks.md
, 
configuring-aws-exit-nodes.md
Browser security features
browser-security.md
DNS over HTTPS (Cloudflare integration)
doh-cloudflare.md
NextDNS integration
nextdns-configuration.md
Cisco AnyConnect with Umbrella alongside Twingate
configuring-anyconnect-with-umbrella.md
Zscaler alongside Twingate
configuring-zscaler-with-twingate.md
Netskope DLP alongside Twingate
netskope-dlp-config.md
Comprehensive DNS guide
dns-ultimate-guide.md
Personal/DIY exit-network VPN — Terraform deploys for Minikube, DigitalOcean Droplets, or DigitalOcean Kubernetes; requires Home/Enterprise plan (Exit Networks unavailable on Starter)
gh-twingate-community-diy-vpn.md
Headless client on Ubiquiti UniFi gateways — systemd-nspawn container intercepting a VLAN's DNS via iptables + bind9 and forwarding through Twingate split-DNS resolvers, for whole-VLAN access with no per-device client
gh-twingate-community-ubiquiti-headless-gateway.md
Third-party DNS filter / AV conflicts — DNSFilter, AdGuard for Mac, Avast Real Site Protection running alongside Twingate
5745151855-dns-using-dnsfilter-alongside-twingate.md
, 
8487611740-dns-using-adguard-for-mac-alongside-twingate.md
, 
6928700605-dns-avast-real-site-protection.md
CGNAT range & multi-interface DNS conflicts — 
100.96/12
collisions, Windows client only honoring the default-gateway interface's DNS, general multi-NIC DNS/resource-access issues
4359531030-cgnat-ip-conflicts-dns-resolution-resource-access-issues-with-twingate.md
, 
1402124326-windows-client-limitations-with-multiple-network-interfaces-with-differing-dns.md
, 
3556574910-potential-dns-or-resource-access-issues-on-devices-with-multiple-network-interfaces-connected.md
Linux DNS client bugs — client fails to start with "All nameservers have failed" (Network Manager v1.42+ incompatibility), general DNS request delays
9539322912-twingate-linux-client-fails-to-start-logs-show-dns-errors.md
, 
4817674373-dns-request-delays-while-using-twingate-on-linux.md
macOS Docker DNS resolution bug — container's first DNS query succeeds, subsequent queries fall back to a non-CGNAT resolver; fix via pinning 
--dns
flags to Twingate resolvers
7318897884-macos-client-docker-container-s-second-connections-to-twingate-dns-resource-fails.md
For comprehensive coverage, see 
references/
 for the full set of doc summaries. Default to checking — category names, third-party integration behavior, and known-conflict lists change.
请查看
references/
获取每周更新的最新文档集。其中包含三类文件：
  • {slug}.md
     —— 
    twingate.com/docs
    页面（产品文档）的摘要。
  • {numeric-id}-{slug}.md
     —— Twingate帮助中心文章：特定症状的DNS冲突报告、精确错误字符串及各平台注意事项。
  • gh-{org}-{repo}.md
     —— Twingate公开GitHub仓库的摘要：社区出口网络部署工具。
用户询问内容…优先查阅
DNS安全概述、配置文件设计、出口节点配置、DoH实施
dns-security-overview.md
、
dns-security.md
DNS过滤分类、允许/阻止列表、配置文件优先级
dns-filtering.md
互联网安全产品范围、许可、客户端配置
internet-security.md
、
internet-security-client-configuration.md
出口网络（出口IP、配置、AWS特定模式）
exit-networks.md
、
configuring-aws-exit-nodes.md
浏览器安全功能
browser-security.md
DNS over HTTPS（Cloudflare集成）
doh-cloudflare.md
NextDNS集成
nextdns-configuration.md
搭配Twingate使用Cisco AnyConnect与Umbrella
configuring-anyconnect-with-umbrella.md
搭配Twingate使用Zscaler
configuring-zscaler-with-twingate.md
搭配Twingate使用Netskope DLP
netskope-dlp-config.md
全面DNS指南
dns-ultimate-guide.md
个人/自制出口网络VPN —— 用于Minikube、DigitalOcean Droplets或DigitalOcean Kubernetes的Terraform部署；需Home/Enterprise计划（Starter计划不支持出口网络）
gh-twingate-community-diy-vpn.md
Ubiquiti UniFi网关上的无头客户端 —— systemd-nspawn容器通过iptables + bind9拦截VLAN的DNS，并通过Twingate拆分DNS解析器转发，实现无需每台设备安装客户端即可访问整个VLAN
gh-twingate-community-ubiquiti-headless-gateway.md
第三方DNS过滤器/杀毒软件冲突 —— DNSFilter、AdGuard for Mac、Avast Real Site Protection与Twingate搭配使用
5745151855-dns-using-dnsfilter-alongside-twingate.md
、
8487611740-dns-using-adguard-for-mac-alongside-twingate.md
、
6928700605-dns-avast-real-site-protection.md
CGNAT范围及多接口DNS冲突 —— 
100.96/12
冲突、Windows客户端仅遵循默认网关接口的DNS、通用多NIC DNS/资源访问问题
4359531030-cgnat-ip-conflicts-dns-resolution-resource-access-issues-with-twingate.md
、
1402124326-windows-client-limitations-with-multiple-network-interfaces-with-differing-dns.md
、
3556574910-potential-dns-or-resource-access-issues-on-devices-with-multiple-network-interfaces-connected.md
Linux DNS客户端漏洞 —— 客户端启动失败并显示“所有域名服务器均已失效”（与Network Manager v1.42+不兼容）、通用DNS请求延迟
9539322912-twingate-linux-client-fails-to-start-logs-show-dns-errors.md
、
4817674373-dns-request-delays-while-using-twingate-on-linux.md
macOS Docker DNS解析漏洞 —— 容器首次DNS查询成功，后续查询回退到非CGNAT解析器；通过将
--dns
标志固定到Twingate解析器来修复
7318897884-macos-client-docker-container-s-second-connections-to-twingate-dns-resource-fails.md
如需全面了解，请查看
references/
获取完整的文档摘要。默认需进行检查——分类名称、第三方集成行为及已知冲突列表会发生变化。