1

I would like to fix a problem in my LAN (Windows 10 Pro clients on 192.168.140.x subnet). I have a Windows 2008 R2 Server (192.168.140.9) that's mainly used as DHCP server and DNS conditional forwarder (non authoritative). Clients PCs need resolution for both public internet hostnames as also a set of private ones (of hosts located on a remote LAN: 192.168.200.x) for all PC in my local LAN. The private hostnames should only be solved by DNS servers on the remote LAN itself. I've configured the DHCP server to assign DNS servers in this order:

8.8.8.8
8.8.4.4
192.168.140.9
192.168.200.8
192.168.200.31

where 192.168.140.9 is my own server acting as DNS. The last two addresses are DNS servers for the remote LAN (but I would like to remove these last two options since they are redundant). My DNS server is configured as a conditional forwarder of the hostnames located in the remote LAN (trough 192.168.200.8 and 192.168.200.31). Using nslookup I can clearly see that everything works (if I set the correct DNS server) but Windows seems unable to solve names in the private side and thus many applications fails to locate private servers (NAS, mail server, intranet web server etc). The only way I can arrange DNS order so it works is to set the two private side DNS servers as first in list:

192.168.200.8
192.168.200.31
8.8.8.8
8.8.4.4
192.168.140.9

This something I would like to avoid because I don't want remote DNS to be charged of resolving internet names.

How can I fix this? I cannot change clients network configuration other than changing DHCP / DNS configuration options (of my own server) and of course I cannot change the remote server DNS behaviour.

  • 1
    Have you tried without the public DNS servers at all in the DHCP config? The local DNS servers should be able to forward any requests for zones they don't own. – Todd Wilcox Nov 15 '17 at 16:53
  • If you meant 192.168.200.8 and 192.168.200.31 I would like NOT to charge them with public net names resolution (as I stated before) if you meant my own server 192.168.140.9 I don't know how to do this. – weirdgyn Nov 15 '17 at 17:01
  • 1
    I mean merely stop handing out 8.8.8.8 and 8.8.4.4 in DHCP. Only hand out the three internal DNS servers. If the three DNS servers you hand out can't resolve a zone, they should forward the resolution request to an external DNS server. That's how it's normally done. The problem you're having now is your clients are using the DNS servers in priority order so if they go to 8.8.8.8 first, they will never resolve local addresses because the public DNS servers will never forward the request back down to the private DNS servers. – Todd Wilcox Nov 15 '17 at 17:04
  • I got this.. how can I handle public resolution trough my own DNS server? Is it something a conditional forwarder? What domain I need to set? – weirdgyn Nov 15 '17 at 17:06
  • 1
    No, it's a non-conditional forwarder. Actually you don't even need a forwarder, just the root hints will suffice. Just try taking a single computer and statically setting its DNS servers to only the internal servers. Or even easier, run nslookup, set the server to be one of the local servers, and query for an A record for a public domain. It should work with a response that says it's "non-authoritative". If that doesn't work, then there's something more unusual going on. – Todd Wilcox Nov 15 '17 at 18:07
0

As suggested by Todd I needed to remove all the DNS options except my own (192.168.140.9) from DHCP configuration. I also set the Forwarders section in the Properties of my DNS server in this way:

Forwarders setup

Now everything seems to work correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.