1

A past MSP configured our Windows servers (2012 R2) like so:

  • SERVER01 (10.0.0.1): DC + DHCP + DNS
  • SERVER02 (10.0.0.2): RRAS

DHCP is handing out IP addresses in the 10.0.0.50-240 range.

DNS is configured for secure dynamic updates, and DHCP uses a credential to register updates in DNS.

RRAS is providing an SSTP VPN, using a single NIC, and is configured to assign IP addresses using DHCP (rather than a static address pool). It has a DHCP Relay Agent set up on the "Internal" interface with 10.0.0.1 in the server list.

All of that is fine when domain-joined laptops are in the office connected directly to the network, because DHCP updates the DNS whenever they renew their leases.

However, when those same laptops are taken out of the office and connect to the VPN, the DNS does not get updated with their new IP addresses, so I can't perform any kind of remote management or deployment using their hostnames until they're brought back to the office.

How do I get the DNS to correctly update with the VPN clients' IP addresses?

Enabling the "Register this connection's addresses in DNS" option on the VPN clients doesn't work because the existing DNS records are owned by the DHCP credential, so the VPN clients do not have permission to directly update the records. (I've verified this by manually giving one of the laptops permission to write to their own DNS record, at which point it was suddenly able to register in DNS via the VPN).

Also, running "ipconfig /all" on the VPN clients shows "DHCP Enabled: No" for the PPP adapter. Is that the expected behaviour? Shouldn't it say "DHCP Enabled: Yes" if the DHCP Relay Agent is actually working?

1

I think I've come up with a reasonable solution for this.

  1. Make sure the laptops have "Register this connection's addresses in DNS" enabled on their VPN connections.
  2. Set a DHCP User Class on all of their network adaptors:
    • ipconfig /setclassid * "MyClass"
  3. Create a DHCP policy in the relevant scope which only applies to DHCP clients who have the aforementioned user class. Configure the policy with a shorter DHCP lease if you wish, but more importantly, configure it to Dynamically update DNS records only if requested by the DHCP clients:
    • DHCP\MyServer\IPv4\Scope [10.0.0.0]\Policies
  4. Optionally, create a GPO for the laptops which configures their DNS clients to refresh their DNS records more regularly and sets a short TTL on the records:
    • Computer Configuration\Administrative Templates\Network\DNS Client\Registration refresh interval
    • Computer Configuration\Administrative Templates\Network\DNS Client\TTL value for A and PTR records

This way, the laptops can control their own DNS records because DHCP is prevented from automatically doing it on their behalf, plus the short TTL means other machines shouldn't cache any of those records for extended periods.

Meanwhile, all of the other PCs on the domain just carry on as normal, because all of the above is policy-based and only applies to those machines with the correct user class and group membership.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.