0

For some reason DNS is not working on the primary (only) domain controller, Server 2008 R2, to resolve external domain names (.com's). DHCP is also installed. It can also not ping IP addresses outside of the network (8.8.8.8) for example and tracert to 8.8.8.8 also fails.

It stopped working when we removed the original firewall and replaced it with a new one. The "Internet" world shows connected on the server but NSLOOKUP's and internet browsing do not work. Firewall is enabled to ALLOW ALL from LAN->WAN and WAN->LAN.

The original firewall was acting as a DHCP/DNS server for the range 192.168.1.1 to 192.168.1.110 and the PDC has DHCP enabled for IP 192.168.1.111 to 192.168.1.199. DNS was pointed to ComCast public DNS servers.

We removed DHCP/DNS from the new firewall and let the server handle it. The workstations were static IP addresses between 192.168.1.2 and x.1.90 but we changed it to use DHCP for easier IP address management. I don't think would cause any issues with DNS, but I put it there in case I'm missing something.

Workstations will do DNS resolution but only if you set them to use a public DNS.

RRAS is installed on the server and it gives out IP's from 192.168.1.112 - 192.168.1.120 and the Internal IP shows as 192.168.1.120. DHCP has these entries in it as reserved for RRAS.

Changing the server's DNS servers to a public IP address does not fix the issue. Changing the server's DNS to the firewall and enabling the firewall to point to an external DNS does not work. Setting the firewall DNS to the PDC fails on external name resolution. Setting the firewall DNS to an external address returns an IP on external name resolution.

DCDIAG /v /test:dns passes everything EXCEPT the DNS forwarders. It says the the forwarder is Invalid (unreachable) for all of them (8.8.8.8, 8.8.4.4, 75.75.75.75, 75.75.76.76, 4.2.2.2).

All Errors/Warnings in the last 24 hours: http://www.pastebin.com/sjfQnmzY

IPCONFIG

Windows IP Configuration

   Host Name . . . . . . . . . . . . : PDC-SVR1
   Primary Dns Suffix  . . . . . . . : THISDOMAIN.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : THISDOMAIN.local

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Intel(R) 82576 Gigabit Dual Port Network Connection
   Physical Address. . . . . . . . . : 00-25-90-69-B1-46
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::504:b3f4:f942:b75b%10(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.1.91(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 167781776
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-17-62-90-5B-00-25-90-69-B1-46
   DNS Servers . . . . . . . . . . . : 192.168.1.91
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 9:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{4D90F81F-E60D-48B1-9D3E-127871C6B6AA}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
  • 1
    "It can also not ping IP addresses outside of the network (8.8.8.8) for example and tracert to 8.8.8.8 also fails." This looks like a firewall issue; your server isn't able to reach the Internet at all, not being able to resolve DNS names is just a side effect. Please add details about your firewall and its configuration. – Massimo Jul 25 '16 at 19:21
  • Firewall has allow/allow all for incoming and outgoing. It's a SonicWall TZ400. Workstations can ping/nslookup, just this server can not. The only difference is workstations are DHCP and server is static. – Travis Jul 25 '16 at 20:18
  • How is the default gateway configured for the server and the workstations? Is it the same, and is it this firewall? – Massimo Jul 25 '16 at 21:02
  • 1
    Also, try uninstalling RRAS on the server. If not configured correctly, it can seriously mess up routing. – Massimo Jul 25 '16 at 21:02
  • 1
    What @Massimo said. Had no end of trouble with RRAS for decades. It really messes up a lot of things. At least disable it to narrow the cause. – Adrien Jul 26 '16 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.