Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Problem

When trying to access internal servers via hostnames using NSLookup (both Windows & Linux/Arch/Debian) I receive the correct DNS server address, FQDN and destination IP address.

When I try to access the same server using a browser or PING, I end up hitting our public "catch-all" IP address. It should be hitting our internal servers. Why is it going outside our network?

Config

  • BIND DNS Server with domain names assigned to appropriate IP Addresses.
  • Router has DNSMasq for DHCP turned on and DNSMasq for DNS turned off.
  • Router LAN Local DNS server is configured to point to our BIND DNS Server.
  • Router has Static IP is assigned to the BIND DNS Server
share|improve this question
2  
Do you have a proxy server configured in your browser? If your browsers are configured to use a proxy server, then DNS isn't performed on the local machine, the proxy server does the DNS resolution. –  Zoredache Feb 12 at 20:10
1  
If the clients are Windows machines, they may also be using NetBIOS broadcast name resolution or LLMNR which won't hit the DNS server, and may also give different results from nslookup –  Chris McKeown Feb 13 at 0:55
    
Hi Zoredache, Just curious, will it be the case. I trust that even after configuring proxy, the resolution should be done by resolv.conf only, and shouldn't be done somewhere from outside.Though I haven't tested it and I am just saying this out of logic from my mind. Please correct me if I am wrong. –  GeekRide Feb 13 at 4:25
    
@GeekRide, if the client is configured to use a HTTP proxy then it will send the HTTP request to the proxy server without doing any name resolution. The proxy server will then perform a DNS lookup and forward the return traffic to the client. There are other methods of proxy-ing traffic, but this is the most common. –  blacklight Feb 13 at 8:08
    
Thanx blacklight. I missed the part of HTTP proxy, as I always used the SOCKS one. thanx again for clarifying. –  GeekRide Feb 13 at 11:59

1 Answer 1

up vote 2 down vote accepted

The difference between nslookup and your browser / ping test is that nslookup will force a DNS lookup, whereas the other tests will will use the normal name resolution lookup order to resolve names.

This involves looking in the DNS cache, as well as static records in the hosts file. It's possible that your computers have static records for your webserver in the hosts file (Windows: C:\windows\system32\drivers\etc\hosts, Linux: /etc/hosts/ ). If a record is in this file then that record will be used, and a DNS lookup will not be performed.

As Zoredache suggested, it may also be a proxy server - as the proxy server will be performing DNS lookups on your behalf (Which will more than likely resolve the public address). That being said, ICMP is not usually proxied - especially in windows, but it's definitely worth investigating regardless.

If you want to troubleshoot - I suggest checking your hosts file, checking the proxy server settings, and if you're still drawing a blank, then flush your DNS cache (Windows: ipconfig /flushdns Linux: /etc/rc.d/init.d/nscd restart) and then run a program like wireshark or tcpdump to determine if your PC is actually sending a DNS request when you do a ping / browser test.

share|improve this answer
    
Nothing in the static hosts files. No proxy, but it looks like there was a caching issue. Each device we had to flush cache AND renew the DHCP lease. Working now. Thanks! –  Concordus Applications Feb 13 at 21:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.