1

This morning I came in to our SOHO office (>5 users) to reports of the internet not working. I tried all the usual simple fixes like cycling switches (each user has a switch at their desk) then I moved on to the hardware firewall and modem, restarting and cycling respectively. One workstation could access the internet, and at first I had no idea why. Long story short, I noticed that the machine that could surf had had DHCP disabled. Every other machine has DHCP enabled and had somehow had it's DNS servers changed from the ones provided by our ISP to some internal address I was not familiar with and not our usual network prefix.

  • Our normal network prefix: 192.168.168.xxx
  • DNS that was put in place of our ISP DNS: 192.168.15.1 (aka mystery IP)

Info:

  • Windows 7 Pro 64 bit
  • Bonded ADSL modem bridged to Sonicwall TZ105 firewall
  • Sonicwall out X0 LAN interface to switch, switch links through infrastructure to switch next to user's desk, then to user's machine.
  • I cannot ping the mystery IP, I get nothing
  • Hardware firewall provides DHCP

All machines showed network connectivity but could not surf or retrieve e-mail from the Exchange server. When I ran the Windows diagnostic it told me that the configuration was correct but the DNS server was not responding. I changed the DNS servers back to our ISP servers and everything was fine. In a few cases I also had to change the default gateway back to our hardware firewall, back from the mysterious IP.

I'm still trying to figure out what happened over the weekend that would cause this issue; other similar issues seem to revolve around some other DHCP server being connected to our network (the rogue DHCP server issue) but nothing unusual was connected to our network and as far as I know nothing else in our network is providing DHCP.

Assorted other info:

  • VM running Debian on my workstation - I hardly ever use it
  • XAMPP on a non-workstation machine - used fairly often but only by me via remote desktop
  • Synology NAS device

I'm shooting in the dark here, so I'm not sure what information is useful. One of my concerns is that we were attacked somehow. I have checked the firewall log but it only goes back to 8:30 this morning, not sure why.

Any insights and suggestions are of course, greatly appreciated.

edit: Looking in the DNS settings for the Sonicwall I see that it is set to dynamically inherit DNS from the ISP DNS servers. Also there is an option called "DNS Rebinding attack prevention" which is enabled; one of many Sonicwall functions that I can guess at but do not know the full implications of.

4
  • 1. Did you verify that your DHCP scope/server options are configured with the correct DNS servers? 2. Is this an AD domain? Assuming yes because you mentioned Exchange Server. If so, where is your DC/DNS and why are you not using that for DNS, as you should?
    – joeqwerty
    Jul 14, 2014 at 21:57
  • Thanks for the reply. 1 The DNS settings are set to "Inherit DNS settings from WAN zone" and both DNS servers specified there are the correct servers. The Dynamic DHCP scopes are set to 192.168.168.1-167 and 172.16.31.1-255. 2 No this is not an AD domain, it's a Windows 7 workgroup. The Exchange server is with our 3rd party e-mail provider.
    – Delaric
    Jul 14, 2014 at 22:13
  • 2
    Sounds like a goof on the ISP's side; bad settings were inherited from your modem. I've had this happen a few times.
    – rtf
    Jul 14, 2014 at 22:25
  • Thanks, I will get in touch with our ISP and see if they know anything about that.
    – Delaric
    Jul 15, 2014 at 16:43

0

You must log in to answer this question.

Browse other questions tagged .