3

I have a Windows 2012 server with two interfaces - public internet facing, and private.

The private interface uses our internal DNS servers. This interface has no gateway. Static IP - not DHCP.

I want to disable the public interface, as we use a proxy for outgoing traffic.

Having disabled it, I'm finding DNS resolution failing:

  • I cannot ping foo.external.com - host cannot be found

  • However, I can nslookup, notice that it connects to our internal DNS, and successfully resolve foo.external.com

  • ipconfig /displaydns DOES show the correct entry. I'm utterly confused why ping does not simply use this entry.

  • If I manually add an entry to local hosts file, for "1.1.1.1 foo", as an experiment, and try ping foo, it fails - cannot resolve host. Same for foo.external.com, and "foo.external.com.". Pinging "foo.external.com", or "foo.external.com." also fails.

  • If, however, I then re-enable the public interface, it all works. Including the hosts file. I can ping "foo" (the resolution aspect). Disable it, and it stops working again.

I've tried all the reboots, ipconfig /flushdns, nbtstat -R stuff.

a) Why is ping (and our application) not able to properly resolve things when the public interface is disabled, despite Windows being able to speak to its DNS server, and cache the result (as shown in ipconfig /displaydns).

b) Why is the hosts file being ignored for the private interface?

Many thanks.

  • 3
    Naturally, when you disable the external interface the server isn't going to be able to ping external resources because the internal interface has no default gateway. The fact that it can resolve the name via the internal DNS server has no bearing on it's ability to communicate with external hosts. I'm not sure why you're conflating DNS name resolution with routability and reachability. The two don't have any bearing on each other. As for your hosts file entry; did you edit the hosts file from an elevated instance of Notepad (or other text editor)? – joeqwerty Jun 24 '16 at 13:51
  • I'm not conflating them. I'm not expecting to be able to ping the external hosts. I am however expecting ping to try and ping the IP it resolves to. It may then fail for routing reasons. But its failing saying it cannot resolve it - when it should be able to. Yes - host file stuff is working in general. If it wasn't, then there's no way "foo" would have ended up visible in ipconfig /displaydns . "foo" doesn't exist anywhere else. – Nik Jun 24 '16 at 16:01
  • Since you can resolve foo.external.com it sounds like DNS resolution is working which is different than trying to ping (ICMP) foo.external.com. Perhaps your proxy settings are not properly configured or preventing your system access to foo.external.com. – user2320464 Jul 1 '16 at 19:56
  • It's not about accessing foo.external.com. The question is why, with one interface disabled (only), and foo.external.com already in the DNS cache (or indeed, in the hosts file), it will not resolve (not connect to). – Nik Jul 2 '16 at 10:13
  • @Nik, your question should be updated to be more clear that you're interested only in why resolution fails when the public NIC is disabled, the the correct entry resides in the HOSTS file and local cache. If ipconfig /displaydns shows the correct entry and/or the correct entry is in the HOSTS file everything should work in a default configuration. That said, have settings been implemented to bypass HOSTS lookup and cache? Requiring a DNS lookup every time? – user2320464 Jul 2 '16 at 18:30
0

A quick Google search returned this user with the same question:

The user took a Wireshark capture and found that when when trying to ping the host, no DNS query was being performed.

The explanation for this behaviour was:

I believe that nslookup opens a winsock connection on the DNS port and issues a query, whereas ping uses the DNS Client service. You could try and stop this service and see whether this makes a difference.

Some commands that will reinitialize various network states :

Reset WINSOCK entries to installation defaults : netsh winsock reset catalog
Reset TCP/IP stack to installation defaults : netsh int ip reset reset.log
Flush DNS resolver cache : ipconfig /flushdns
Renew DNS client registration and refresh DHCP leases : ipconfig /registerdns
Flush routing table : route /f (reboot required)

  • Thanks, bit that neither answers my (a) nor (b) questions. – Nik Jul 1 '16 at 18:52
  • Have you tried all of the suggestions? – Mark Riddell Jul 1 '16 at 18:53
0

Are your internal DNS Servers on the same subnet as your private interface ? If not, then your server will not know a route to your DNS Servers, and your DNS query will fail. Add a gateway to your private network settings, or add a static route, so your private NIC knows what it can reach from it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.