Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Note: Wrong assumptions

It turned out that the VPN is configured to redirect all name lookups to a different server. So the problem is not the Windows DNS but the VPN Gateway.

Original Quesiton

I have a remote network 10.12.0.0/16 with a Windows Domain Controller (SBS 2011) and a VPN Gateway. Some Windows PC (no domain member) uses a l2tp VPN to connect to the SBS. It gets a virtual IP in 10.14.0.0/24. The VPN gateway is the SBS's default gateway and routes between the two networks. SBS and client can ping each other.

The Domain Controller owns the Active Directory Domain company.local. If I nslookup it on the SBS it is correctly resolved to the IP of the SBS. A query from the VPN Gateway works as well. But a nslookup company.local 10.12.0.5 (later is the SBS IP) from the client will respond that the domain is not found. Via tcpdump on the VPN gateway I can see that the SBS really returns NXDOMAIN 0/0/0.

As you might already guess the goal is to join the domain with the VPN connected computer.

Why does the DNS Server not return the correct A Record? My only idea is that the query comes from an unknown private network.

Update 01

Full query from the client computer:

C:\Users\abc>nslookup -debug company.local 10.12.0.5
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 1, rcode = NOERROR
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
        5.0.12.10.in-addr.arpa, type = PTR, class = IN
    ANSWERS:
    ->  5.0.12.10.in-addr.arpa
        name = xyz.cloud.internal
        ttl = 0 (0 secs)

------------
Server:  xyz.cloud.internal
Address:  10.12.0.5

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NXDOMAIN
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        company.local, type = A, class = IN

------------
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 3, rcode = NXDOMAIN
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        company.local, type = AAAA, class = IN

------------
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 4, rcode = NXDOMAIN
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        company.local, type = A, class = IN

------------
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 5, rcode = NXDOMAIN
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        company.local, type = AAAA, class = IN

------------
*** xyz.cloud.internal can't find company.local: Non-existent domain

Update 02

C:\Users\abc>nslookup -debug _ldap._tcp.dc._msdcs.company.local.
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 1, rcode = NOERROR
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
        5.0.12.10.in-addr.arpa, type = PTR, class = IN
    ANSWERS:
    ->  5.0.12.10.in-addr.arpa
        name = xyz.cloud.internal
        ttl = 0 (0 secs)

------------
Server:  xyz.cloud.internal
Address:  10.12.0.5

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NXDOMAIN
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        _ldap._tcp.dc._msdcs.company.local, type = A, class = IN

------------
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 3, rcode = NXDOMAIN
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        _ldap._tcp.dc._msdcs.company.local, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  (root)
        ttl = 10789 (2 hours 59 mins 49 secs)
        primary name server = a.root-servers.net
        responsible mail addr = nstld.verisign-grs.com
        serial  = 2013011600
        refresh = 1800 (30 mins)
        retry   = 900 (15 mins)
        expire  = 604800 (7 days)
        default TTL = 86400 (1 day)

------------
*** xyz.cloud.internal can't find _ldap._tcp.dc._msdcs.company.local.: Non-existent domain
share|improve this question
2  
Two things: 1. To simplify your troubleshooting simply turn on debugging in nslookup on the client (set debug). That way you'll see the full query and the full answer without having to run a tcpdump. You'll clearly see the NXDOMAIN returned from the server in nslookup with debug turned on. 2. After setting debug you'll see the full query from the client. Hopefully that wqill give you some insight. –  joeqwerty Jan 15 '13 at 16:58
1  
@CodingGorilla - Off topic. Apologies. It's been awhile. Good to see you. –  joeqwerty Jan 15 '13 at 17:00
1  
I'm not sure if this is just because you were trying to obfuscate some of the names or not, but I notice the server is xyz.cloud.internal, but you are querying for company.local. Is this server authoritative for company.local? –  Coding Gorilla Jan 15 '13 at 17:24
1  
I agree with @CodingGorilla - There's a mismatch between the server DNS suffix and the DNS suffix you're querying for: company.internal versus company.local. If the zone is named company.internal and the server doesn't have a zone named company.local then that would explain the failure. Are you assigning the DNS suffix to the VPN client via DHCP? If so, my guess is that you're assigning the wrong DNS suffix. –  joeqwerty Jan 15 '13 at 17:37
1  
@Thomas Is it possible that the VPN is intercepting/modifying the DNS queries? Can you do the same query on the local network and have it return the proper results? –  Coding Gorilla Jan 16 '13 at 16:35
show 18 more comments

1 Answer

up vote 0 down vote accepted

The problem (as troublehsot in the comments) ends up being the VPN gateway was intercepting the DNS queries.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.