1

We have a site to site tunnel with using a Meraki router to the Google Cloud. Pings and normal traffic flows between the two sites. The server on the Google Cloud side is a domain controller running DNS. However, the Google side of the tunnel will not return queries.

We did packet captures on the Meraki side and they show that the traffic is leaving over the tunnel but there's no response. I verified that I have the following in the firewall section on Google's side:

vpn-dns Ingress Apply to all IP ranges: 0.0.0.0/24 tcp:53, udp:53 Allow 65534 default

Thoughts on what may be missing or how to pinpoint? The domain controller has all firewalls turned off. You can RDP to it and ping it from the remote location as well.

1
  • Run a capture on the server to see if the DNS traffic is in fact getting to it and what it's doing with it if it is. – joeqwerty Mar 12 '18 at 20:51
1

The existing firewall rule on the Google side

vpn-dns     Ingress     Apply to all    IP ranges: 0.0.0.0/24   tcp:53, udp:53  Allow   65534   default

does not look correct. This could be a reason why DNS requests are not delivered to the port 53 of the DNS server in Google Cloud.

You should change this rule and set

Source IP ranges = 0.0.0.0/0

Virtual Private Cloud > Doc > VPC network overview > Subnet creation mode > Subnet ranges > Restricted ranges
Wikipedia > Reserved IP addresses > IPv4
IETF > RFC 6890 > Special-Purpose IP Address Registries > Introduction
IETF > RFC 6890 > Special-Purpose IP Address Registries > IANA Considerations > Restructuring of the IPv4 and IPv6 Special-Purpose Address > 2.2.2 IPv4 Special-Purpose Address Registry Entries

0

Can you run a dig command from your client machine to one of the machines the DNS server resolves for and share the results?

Take into account that the Google Cloud DNS server that you have at the other end has to be registered with higher level DNS servers in order to be reached as explained in this page. If not, the world has no way of knowing you have a DNS server service on the Domain Controller.

If you have already registered the DNS server, then you have to look at your client configurations as well, check your client machine name, domain name and name server you have set up.
If it’s a Linux machine you should look at the configurations in /etc/resolv.conf and add the nameserver which depends a bit on which unix version you have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.