No internet access on domain controller VM

[toffee_paul]

Hi all,

 

Having an issue with our domain controller, for the past few weeks we've not been able to access the internet from a browser on it. I can ping other devices on the network from the DC but when I try and ping Google or BBC or anything else I get "Ping request could not find host google.co.uk. Please check name and try again."

 

Chrome says "This site can't be reached. www.google.co.uk's server IP address could not be found. DNS_PROBE_FINISHED_BAD_CONFIG.

 

Tried rebooting the DC but hasn't worked. Internet access from other VMs on the Hyper-V is fine, it's just DC1.

Everything else if fine apart from this, all devices can access roles installed on the DC, incl. network shares, print server etc. WSUS is installed on this DC though so it's not pulling through latest updates which is starting to worry me now as clients won't receive them either.

Any ideas?

 

Thanks in advance.

Edited April 12, 2018 by toffee_paul

[derf]

No DNS forwarder setup on the DC would be my guess.

[toffee_paul]

I've checked the Forwarders and both Virgin Media's entries are present. Any other ideas?

 

This is driving me insane, I've restarted the entire physical Hyper-V host now so everything's had a clean boot and this VM is the only one that doesn't access the internet out of 4 running on Hyper-V.

[derf]

Double check the DNS settings on your TCP/IP config, try pointing to a known DC DNS server that works, then work backwards from there

[toffee_paul]

Ok still having this problem. No internet connectivity on DC and ping not working either. When I change the Preferred DNS server from 192.168.1.20 (which is also the IP of the DC running the DNS role), to Google's public IP 8.8.8.8 or even to the IP of our Smoothwall, internet connectivity returns. The Preferred DNS setting has always been the IP of the DC itself so I have no idea what's going on.

 

Anyone any ideas?

[JackCPickup]

Set 127.0.0.1 instead of 192.168.1.20 and test.

 

What if you temporarily set 8.8.8.8 as the first DNS Forwarder and keep the DNS settings the same on the NIC?

 

What DNS server is the rest of the network using?

[Davit2005]

Have you only one DNS server.

 

Can you do a tracert to 8.8.8.8 and 8.8.4.4

 

Forwarders should point to suitable external DNS servers. In the IPv4/IPv6 either point it to local host or the IP address of the local machine and in the secondary DNS point it to a Secondary DNS server if you have one. Somepeople might do this the other way around.

[JackCPickup]

In the IPv4/IPv6 either point it to local host or the IP address of the local machine and in the secondary DNS point it to a Secondary DNS server if you have one. Somepeople might do this the other way around.

 

If you're using multiple DNS servers always point to the other one first and itself as secondary or you risk the DNS Island Effect.

[toffee_paul]

All clients are using 192.168.1.20 and can reach internet with no issues.

 

First I added 8.8.8.8 as the first forwarder in the list (retaining existing NIC settings as advised) and it validated immediately to 'google-public-dns-a-google.com' but still no internet connectivity.

 

Then I tried setting the DNS server on NIC to 127.0.0.1and this worked and sites are loading nicely.

 

What does this mean then? If the DC (the only one on the network) has IP of 192.168.1.20, and has the DNS and DHCP roles installed, can't access the internet and can't ping using it's own IP address as the Preferred DNS server, but works with 127.0.0.1 .... why would that be?

[Davit2005]

If you're using multiple DNS servers always point to the other one first and itself as secondary or you risk the DNS Island Effect.

 

Not necessarily

 

The "DNS Can Become an Island" issue was from Windows 2000, not Windows 2003 or newer. Windows 2000 SP4 that was released in the summer of 2002, addressed and corrected the issue. For quite some time after that, and because of that, the mindset was to point to another first, then itself as the second to "just in case" to prevent any island issues. But it wasn't necessary and it really came down to what was best for the scenario.

 

The whole DNS settings question has been debated/argued by Microsoft engineers since AD's pre-RTM time frame (around 1999). The consensus among Microsoft engineers now is to set the first entry to a partner/replica, and the second DNS entry to itself or the loopback, kind of like what we did to eliminate the Island thing. Matter of fact, the BPA now looks for that.

 

So, the answer is .... is actually based on who you ask. Even Microsoft engineers have been discussing this for over 14 years.

 

I do always run DC DIAGs and DNS tests before and after I introduce any new domain controllers or upgrades on Domain Controllers.

 

 

https://social.technet.microsoft.com/Forums/ie/en-US/b7bf37a2-6e1a-40a8-8d4b-1c15ee9bc0fa/2k8-best-practice-for-setting-the-dns-server-list-on-a-dcdns-server-for-an-interface?forum=winserverNIS

Edited April 20, 2018 by Davit2005

[JackCPickup]

All clients are using 192.168.1.20 and can reach internet with no issues.

 

First I added 8.8.8.8 as the first forwarder in the list (retaining existing NIC settings as advised) and it validated immediately to 'google-public-dns-a-google.com' but still no internet connectivity.

 

Then I tried setting the DNS server on NIC to 127.0.0.1and this worked and sites are loading nicely.

 

What does this mean then? If the DC (the only one on the network) has IP of 192.168.1.20, and has the DNS and DHCP roles installed, can't access the internet and can't ping using it's own IP address as the Preferred DNS server, but works with 127.0.0.1 .... why would that be?

 

If you run arp -a in cmd on the DC do you have multiple physical addresses for 192.168.1.20?

[JackCPickup]

Not necessarily

 

 

 

I do always run DC DIAGs and DNS tests before and after I introduce any new domain controllers or upgrades on Domain Controllers.

 

 

https://social.technet.microsoft.com/Forums/ie/en-US/b7bf37a2-6e1a-40a8-8d4b-1c15ee9bc0fa/2k8-best-practice-for-setting-the-dns-server-list-on-a-dcdns-server-for-an-interface?forum=winserverNIS

 

It is still best practice to help avoid replication issues, as in your quote it is Microsoft's recommendation.

[toffee_paul]

No, the IP of the DC isn't shown in the list at all Edited April 20, 2018 by toffee_paul

[Davit2005]

It is still best practice to help avoid replication issues, as in your quote it is Microsoft's recommendation.

 

 

The term used was "The consensus among Microsoft engineers" .

 

There is a lot of debate on this subject on the Internet. Whether or not you should use a loopback address adds more confusion.

 

Configure network adapters on this DNS server to use the loopback address (127.0.0.1, 0:0:0:0:0:0:0:1, or ::1) as one of the DNS servers, but not as the first DNS server on the list. If the loopback address is configured as the first DNS server, then configure another DNS server first.

Edited April 20, 2018 by Davit2005

[toffee_paul]

Here are the results of the dcdiag /test:dns

(performed using the 192.168.1.20 as the Preferred DNS server, not the 127.0.0.1 that JackCPickup said to try)

 

Edited April 20, 2018 by toffee_paul

[toffee_paul]

Ok thought I'd close this off and say it's not fixed. Appears that uninstalling MalwareBytes fixed the problem. And there's me thinking that software is the dogs ********* well not anymore!

[SHimmer45]

malwarebytes on a DC.

not something i would have thought was a good idea

[toffee_paul]

malwarebytes on a DC.

not something i would have thought was a good idea

 

Remnants inherited from the previous incumbent of my role.