Windows Forum

Ask something
Discussion Locked

VPN /Windows 2000 Queries ISP's DNS

0 helpful
3 replies

by brian_seader

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have run into an issue with some Windows 2000 clients using a single tunnel VPN, (Nortel).

We have an Intranet where some pages have a public address for accessibility over the Internet, and also resolve internally to a private address. The namespace is the same internally and externally, ie. myserver.mydomain.com.

We have Windows 2000 clients that connected to various ISP's, both cable modem and DSL. When using certain providers, while tunneled in to our network the intranet page is requested through the ISP's DNS server rather than the internal DNS server. The same system can be taken to another location using the same ISP and the query is only sent to the internal DNS server, as it should.

For example, take the system and hook it up to a roadrunner cable modem here in the HQ, connect VPN, ping myserver.mydomain.com. The query is sent to the internal DNS server and resolves to the internal IP.

Take the same system and connect it to a roadrunner cable modem 5 miles away, do the same procedure, but this time the query is sent to the ISP's DNS server which of course resolves to the public IP address, however while tunneled in the clients cant get to that address due to the VPN tunnel.

This is happening withvarious systems, across multiple providers (both DSL and cable). We've looked at subnets, IP assignments of these problem clients and can see nothing which conflicts with our internal IP addressing scheme.

Has anyone run into this? Regardless, any ideas?

3 replies

by avswamy

small idea i am giving here i hope this works

nortel firewall looks for a dedicated ip address who is connecting while through isp or any other connectivity if it is connected from a private network nortel won't allow that connection in additionto this configure the domain resolution things in clients configure first dns server as your dns server public ip address and configure additional dns server as isp dns server address.

i hope this will solve your problem.

by brian_seader

Thanks for the response. Working with Microsoft we've discovered this is actually a bug in Windows 2000 that has not yet been addressed. The Q article covering this is still being drafted at this time and isn't available publicly, however the issue deals with the binding order of network adapters on Windows 2000 professional. Unfortunately the article is classified as a Partner Level article and I can't post compelte details due to confidentiality agreements. Needless to say, Windows 2000 should use the the DNS server of the adapter with the highest binding order, however changing the binding order doesn't change the DNS server used (or in this case adding an adapter such as the Nortel VPN virtual adapter). The workaround that we are taking is to ensure we do not use the same namespace internally as externally, therefore ensuring the ISP's DNS servers do not have records of the affected URL's. Something for you all to watch out for if your getting your feet wet in VPN's.

PS. The issue also affects DUN connections.

This discussion is closed to new replies.