Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a small branch with few computers with few computers connected via the Internet to our central building. We don't use site-to-site, but dial-in to the Cisco router (we use ShrewSoft as a client and pull network configuration from the RADIUS server).

Everything was working just fine, but our tel-co was messing around with something (not clear what) as they had promised. Yesterday I got a call from the branch and they said they could browse the Internet, but can't access our internal web servers. I started investigating and it turned out the VPN settings were all messed up, OK fixed that.

The most interesting part is the DNS stuff. After I restored the VPN, I connected using RDP to their computer and tried pinging our Internal DNS server ( and Google's DNS ( That worked fine. I then tried nslookup - works fine. Then nslookup - that works fine! BUT trying to resolve any of our internal addresses fails. We have a few of DNS servers and all of them fail. Looks like the reply never gets back. From internal network it works fine. But how does that happen: nslookup resolves our dns server's FQDN using reverse lookup?? It doesn't have anything to do with firewalls, right? Reverse lookup gets a reply. Help me please, in which direction should I look?


PS. To the left of the cloud is our central building, to the right - branch.

PPS. I've written the needed records to the hosts file just as a temporary workaround so they could do their job.

PPPS. Cannot really check with other computers in branch as they don't use VPN and the employees there are in their 60s so they don't understand a thing and can do only very simple things.

share|improve this question
Stupid question, but it doesn't actually state this. Are you sure that your clients DHCP servers on the remote side are providing them with the correct internet DNS servers when they get their DHCP addresses? – DKNUCKLES Aug 8 '13 at 13:31
Yes, everything is correct. I tried nslookup with different servers... so it's not about addresses – Alex Aug 8 '13 at 13:33
"From internal network it works fine." can you clarify what you mean? Does a normal nslookup work when you are on the central building network and not from a branch PC over the VPN when you do nslookup But doing nslookup does work on the branch PC? – TheCleaner Aug 8 '13 at 14:05
Yes nslookup works absolutely fine when at central building. But at the branch site you can only receive non-authoritative replies (but not our internal network records). Also you do get back replies from reverse lookups at branch – Alex Aug 8 '13 at 15:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.