1

Problem

When trying to access internal servers via hostnames using NSLookup (both Windows & Linux/Arch/Debian) I receive the correct DNS server address, FQDN and destination IP address.

When I try to access the same server using a browser or PING, I end up hitting our public "catch-all" IP address. It should be hitting our internal servers. Why is it going outside our network?

Config

  • BIND DNS Server with domain names assigned to appropriate IP Addresses.
  • Router has DNSMasq for DHCP turned on and DNSMasq for DNS turned off.
  • Router LAN Local DNS server is configured to point to our BIND DNS Server.
  • Router has Static IP is assigned to the BIND DNS Server
Improve this question
6
  • 2
    Do you have a proxy server configured in your browser? If your browsers are configured to use a proxy server, then DNS isn't performed on the local machine, the proxy server does the DNS resolution.
    – Zoredache
    Feb 12, 2014 at 20:10
  • 2
    If the clients are Windows machines, they may also be using NetBIOS broadcast name resolution or LLMNR which won't hit the DNS server, and may also give different results from nslookup
    – Chris McKeown
    Feb 13, 2014 at 0:55
  • Hi Zoredache, Just curious, will it be the case. I trust that even after configuring proxy, the resolution should be done by resolv.conf only, and shouldn't be done somewhere from outside.Though I haven't tested it and I am just saying this out of logic from my mind. Please correct me if I am wrong.
    – Napster_X
    Feb 13, 2014 at 4:25
  • @GeekRide, if the client is configured to use a HTTP proxy then it will send the HTTP request to the proxy server without doing any name resolution. The proxy server will then perform a DNS lookup and forward the return traffic to the client. There are other methods of proxy-ing traffic, but this is the most common.
    – blacklight
    Feb 13, 2014 at 8:08
  • Thanx blacklight. I missed the part of HTTP proxy, as I always used the SOCKS one. thanx again for clarifying.
    – Napster_X
    Feb 13, 2014 at 11:59

1 Answer 1

Reset to default
3

The difference between nslookup and your browser / ping test is that nslookup will force a DNS lookup, whereas the other tests will will use the normal name resolution lookup order to resolve names.

This involves looking in the DNS cache, as well as static records in the hosts file. It's possible that your computers have static records for your webserver in the hosts file (Windows: C:\windows\system32\drivers\etc\hosts, Linux: /etc/hosts/ ). If a record is in this file then that record will be used, and a DNS lookup will not be performed.

As Zoredache suggested, it may also be a proxy server - as the proxy server will be performing DNS lookups on your behalf (Which will more than likely resolve the public address). That being said, ICMP is not usually proxied - especially in windows, but it's definitely worth investigating regardless.

If you want to troubleshoot - I suggest checking your hosts file, checking the proxy server settings, and if you're still drawing a blank, then flush your DNS cache (Windows: ipconfig /flushdns Linux: /etc/rc.d/init.d/nscd restart) and then run a program like wireshark or tcpdump to determine if your PC is actually sending a DNS request when you do a ping / browser test.

Improve this answer
1
  • Nothing in the static hosts files. No proxy, but it looks like there was a caching issue. Each device we had to flush cache AND renew the DHCP lease. Working now. Thanks!
    – Concordus Applications
    Feb 13, 2014 at 21:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .