The DNS resolution can happen, but the resolved IP is not reachable (for example, if in front of it is another firewall that would block some traffic). This should allow the identification of the type of DNS issue that is being faced.Īnd see if the DNS resolution for the website is actually happening by using: Reproduce the issue with these logs enabled. # diag wad filter src x.x.x.x <- Where x.x.x.x is the IP address of a test workstation. # diag test app dnsproxy 12 <- Show Hostname cache. # diag test app dnsproxy 8 <- Dump DNS DB. # diag test app dnsproxy 7 <- Dump DNS cache. # diag test app dnsproxy 3 <- Dump DNS setting. # diag test app dnsproxy 2 <- Show stats. After the issue was reproduced, the packet capture can be stopped with Ctrl+C. Run this sniffer trace (after having checked that DNS packets can actually be captured) and let it run until several 'Gateway Timeout' issues have been received in a browser. Where and are the DNS servers which are configured on the FortiGate. # diagnose sniffer packet any '(host or host ) and port 53' 6 0 a The following steps might provide more insight into the cause of the issue (these debugs need to be run in parallel CLI sessions, preferably over multiple SSH sessions with saved session output):ġ) Get a DNS packet capture from the FortiProxy in SSH session 1: The message received is most probably generated if the FortiProxy either did not receive a DNS response for the host-name or the response it received was not good (not reachable/not understandable etc).

The 504 Gateway Timeout HTTP code indicates that the server while acting as a gateway or proxy, did not receive a timely response from an upstream server it needed to access in order to complete the request.

Tor proxy error 504