0

Situation: 20 computers in the same windows workgroup. They are connected with some switches. Then there is router and a firewall (2 separate hardware, but I don't know how they are connected) with the physical ADSL modem to the internet.

Computers have mostly windows XP, some windows 7. In the TCP/IP configuration of each computer, there is a fixed IP address, and the gateway is the router's IP. The DNS are those of the ISP, or the IP address of the router. In the router configuration (via http), I saw a page where DNS was set to "from ISP".

Suddendly happened a problem: when browsing websites, some computers begun to receive a official ISP page that says "you have problems with DNS, we suggest you to use automatic DNS". Other services stopped working (banking, and things that needed to resove addresses for communications)

I phoned to the ISP and they told me they were having problems with DNS.

So I thought: if I change DNS on my computer TCP/IP config (say openDNS for example), than I will use those DNS and bypass the ISP broken DNS. BUT the problem was still there. No matter how I set DNS, I still receive ISP error webpage. I also tried to change the firewall DNS (from "from ISP" to openDNS), no success.

So another guy (sort of 50 years old Linux fanboy) claimed that "Linux does not have problems, and the DNS I set here will be used, it does not depend from ISP". Apart from trolling.... I asked him "so why I still receive ISP error page, if I use different DNS?"

So now, I would like to understand what happened.

I restarted PC, I "ipconfig /flushdns", and empty all browser's data, so to start fresh.

I kindly ask the community these:

  1. Assuming no other NAT/rules exists, if my PC ha open DNS, and the router has ISP DNS, who wins?
  2. Is it true that with a port forwarding rule (all traffic to port 53 --> force go to DNS of my choice) I am able to force the use of my DNS of choice for the entire LAN, even if client PC have specified a different DNS?

2 Answers 2

1

Let's say you're at one of the workstations browsing the web. You type google.com into your browser's address bar. Assume you don't already have anything cached.

The DNS servers that are set in your TCP/IP configuration on your workstation will be used. Let's say that's your router. Since your router does not host google.com, (again assume nothing is cached,) your router will forward your query on to your ISP's DNS server as long as it is configured to do so. Your ISP doesn't host the google.com zone either, and the query will get forwarded on like so until google.com is found, and then the query will eventually be returned to you. (After that, DNS servers will cache responses so that DNS queries will be faster next time.)

  1. If you put in your TCP/IP settings on your workstation, a DNS server of 8.8.8.8 (Google's public DNS server,) DNS queries from your workstation will go straight to 8.8.8.8 out on the internet. Neither your router nor your ISP will be used at all for DNS.

  2. Port forwarding should not be concerning you right now as far as I can tell. Port forwarding is mainly used for when you are hosting a service behind a NAT address. But we're not hosting a service. We're trying to access one (DNS.) Since you have workgroup computers, you can't really "force" the other workstationss to use a certain DNS server. Any administrator can change the DNS servers on their workstations to whatever they want. You could hand out a DNS server via DHCP to your clients, but you mentioned that you are not using DHCP.

Edit: After reading #2 a little more I think I understand better what you're asking. Yes, it is possible to use a router to redirect traffic based on its port. But not with just any off the shelf router that your ISP gave you. You need a good router that has that capability. Your ISP could even be doing this to you.

1

Some ISP's use DNS hijacking:

https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_ISPs

1
  • I made a test with nslookup (on windows xp). With ISP DNS, I type "nslookup www.fooldomain123.uk", I got "Server: ns.interbusiness.it, Address: 151.99.125.1, *** ns.interbusiness.it can't find www.fooldomain123.uk: Non-existant domain". Mar 4, 2013 at 7:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .