Windows Forum

Ask something
Discussion Locked

DNS help

0 helpful
7 replies

by cp409sd

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a win2k server(only one in my network). It is behind a linux ipchains firewall, which is the win2k machine's gateway out to the internet. I have set up my ISP's DNS servers(primary and secondary) in the 'Forwarders' tab under the 'Properties' of the name of my server in DNS. I don't have my ISP's DNS servers listed anywhere else on windows 2000(specifically under TCP/IP) settings.

I can't seem to figure out why the log my firewall produces(on linux) keeps filling up with rejected requests to send packets to what seems like other DNS servers my ISP has. It seems like win2000 is basically trying lots of different addresses, all out port 53(DNS port), in hopes of getting to another DNS server. I guess I don't really understand the role DNS plays in active directory. My only guess is that maybe my ISP's DNS servers are busy and directing them to go to other DNS servers?? I really don't want to just start letting things through my firewall I don't fully understand. I don't doubt I have something about active directory or DNS on the win2k machine set up wrong...just can't figure out what. I am kind of lost when it comes to forward and reverse lookup zones. Any help you can provide is appreciated!

7 replies

by mckaytech

I don't know if this is an answer for your scenario, but I use a W2K server behind a Linux/IPChains firewall and run DNS caching software on the firewall itself. In W2K, I use the DNS cache (firewall IP) as the primary and the ISP DNS as the secondary and tertiary DNS addresses.

I allow outbound traffic on port 53 to all destinations to resolve requests not resolveable by the cache but do not allow inbound port 53 since the ISP servers are authoritative for my domain.

paul

by aaron_wurthmann

Paul as usual is right on this one, open outbound port 53 or enable some sort of DNS caching on the Gateway. Only I think that I can explain your anomaly further. You have configured a DNS server here think about it how does a DNS server get info about other domains and suffixes? If you answered another DNS server you would be wrong or partially correct anyway. DNS servers contact the root servers occasionally to get updated suffix information, that more then likely is what you are seeing. Check the root server hints tab for your subnet/domain in DNS. Make sure it isn?t grayed out. If it is, repost the question or leave a comment here and I?ll walk you through fixing it. In any account I suggest that you capture the ip addresses in your firewall log and do a whois and tracert to find out who they are. They are probably the root servers but I would just double check to be safe.

by cp409sd

I did check the whois db and they are indeed from my isp. I will let those through my firewall. I don't however have anything even close to my network in the 'Root Hints' of DNS. I just have quite a few addresses that don't mean anything tome. If you could let me know what info I want to put in here that would be great. I only have one server, but not sure what records I want to select for it. Thanks.

by aaron_wurthmann

Thats funny, I was just comming here to post the root hints when I noticed that you asked me to "post the root" hints. Or actually you said could you give me an idea of what you should see here.

I don't think what I am discribing is your problemsince the addresses appear to be your ISPs DNS server but any how...

First of all you should select the DNS server in the DNS MMC and right click on it then select properties. The is a tab called "Root Hints" you should see the following inofmation: (this info was addapted form the dns server cache so its in another format, but you get the idea)

a.root-servers.net 198.41.0.4
b.root-servers.net 128.9.0.107
c.root-servers.net 192.33.4.12
d.root-servers.net 128.8.10.90
e.root-servers.net192.203.230.10
f.root-servers.net 192.5.5.241
g.root-servers.net 192.112.36.4
h.root-servers.net 128.63.2.53
i.root-servers.net 192.36.148.17
j.root-servers.net 198.41.0.10
k.root-servers.net 193.0.14.129
l.root-servers.net 198.32.64.12
m.root-servers.net 202.12.27.33

Keep in mind I didn't enter this info into any DNS server that I have ever built ussualy it just appears. There have however been times when the info on root hints tab was grayed out and what I had to do was delete the domain or subnet under the forward lookup zones and recreate it. For some reason or another depending on when you install DNS for AD (during the OS install or during the AD install or possibly depending on your domain suffix, .com, .net, .local) yourDNS server can botch things up and claim that it is a root server. Again what I have had to do.. (three or four times now) is delete the domain or subnet from the forward lookups zones folder and then recreate it. Make sure to you specify the type to be AD-interactive when you recreate it.

I don't think that this is what you are experincing but if the root servers hints tab is blank or grayed out you may want to try.

by cp409sd

Thanks for the help. It looks like my root hints are there and not greyed. I am receiving some netlogon errors in the event log that I think are due to improper DNS settings though. Probably something I will just have to play around with. Again, thanks for the help.

Also thanks to pmwright@home.com for the help as well.

This discussion is closed to new replies.