# DNS UDP bypass rule not working, advise please
**URL:** https://forum.suricata.io/t/dns-udp-bypass-rule-not-working-advise-please/4900
**Category:** Help
**Tags:** rules
**Created:** [October 15, 2024, 9:45am UTC](https://forum.suricata.io/t/dns-udp-bypass-rule-not-working-advise-please/4900 "2024-10-15T09:45:12Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@atbohmer](https://forum.suricata.io/u/atbohmer)
#### Post date: [October 15, 2024, 9:45am UTC](https://forum.suricata.io/t/dns-udp-bypass-rule-not-working-advise-please/4900/1 "2024-10-15T09:45:12Z")
Hello,
Made 2 rules to habe Suricata bypass and not analyze DNS traffic from known DNS servers, but it seems they are ignored. Any ideas please?
Thanks!
Andre
]# suricata -v
Suricata 8.0.0-dev (378f678d9 2024-10-14)
suricata.yaml:
outputs:
eve.json:
types:
- dns:
version: 3
requests: yes
responses: yes
local.rules:
# ByPass DNS known dns servers
pass udp $DNS\_SERVERS 53 → any any (bypass; sid:100000050; rev:1; )
pass udp $HOME\_NET any → $DNS\_SERVERS 53 (bypass; sid:100000051; rev:1; )
---
### Author:  [@atbohmer](https://forum.suricata.io/u/atbohmer)
#### Post date: [October 15, 2024, 11:00am UTC](https://forum.suricata.io/t/dns-udp-bypass-rule-not-working-advise-please/4900/2 "2024-10-15T11:00:34Z")
Seems like this is processed before the bepass rule. If disabling request/response there is indeed no udp traffic according to previous bypass rules.
- dns:
version: 3
requests: yes
responses: yes
---
### Author:  [@vjulien](https://forum.suricata.io/u/vjulien)
#### Post date: [October 15, 2024, 12:06pm UTC](https://forum.suricata.io/t/dns-udp-bypass-rule-not-working-advise-please/4900/3 "2024-10-15T12:06:17Z")
Parsing DNS happens before the rules are evaluated, but I would still expect the logging to not run for this flow. Smells like a bug to me.
Btw if your goal is to disable dns logging you can also use the config keyword:
[https://docs.suricata.io/en/latest/rules/config.html#config-rules](https://docs.suricata.io/en/latest/rules/config.html#config-rules)
---
### Author:  [@atbohmer](https://forum.suricata.io/u/atbohmer)
#### Post date: [October 16, 2024, 9:30am UTC](https://forum.suricata.io/t/dns-udp-bypass-rule-not-working-advise-please/4900/4 "2024-10-16T09:30:27Z")
Ok, thanks, need some help with that.
Would this disable all dns, or dns query and answer logging?
config dns $DNS\_SERVERS any → any any (dns.answer; config: logging disable, type tx, scope tx; sid:1;)
config dns any any → $DNS\_SERVERS any (dns.query; config: logging disable, type tx, scope tx; sid:1;)
Or all:
config dns $DNS\_SERVERS any → any any (config: logging disable, type tx, scope tx; sid:1;)
config dns any any → $DNS\_SERVERS any (config: logging disable, type tx, scope tx; sid:1;)
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [November 4, 2024, 10:03pm UTC](https://forum.suricata.io/t/dns-udp-bypass-rule-not-working-advise-please/4900/5 "2024-11-04T22:03:00Z")
Did you try those rules?
---
### Author:  [@atbohmer](https://forum.suricata.io/u/atbohmer)
#### Post date: [November 5, 2024, 8:17am UTC](https://forum.suricata.io/t/dns-udp-bypass-rule-not-working-advise-please/4900/6 "2024-11-05T08:17:08Z")
This combination for sure did the job, thanks.
pass dns $DNS\_IB any → any any (bypass; sid:100000050; rev:2; )
pass dns any any → $DNS\_IB any (bypass; sid:100000051; rev:2; )
config dns $DNS\_IB any → any any (config: logging disable, type tx, scope tx; sid:100000052;)
config dns any any → $DNS\_IB any (config: logging disable, type tx, scope tx; sid:100000053;)