This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS not working in PPTP VPN

I am running v7.403 and can't get DNS to work on a PPTP VPN. While I have the VPN connection active, I can ping the internal DNS server by its address of 192.168.0.3 but not by name. I am using the default network address of 10.242.1.x for the VPN pool.

This DNS server is configured in Remote Access - Advanced - DNS, and
ipconfig /all on the vpn client shows 192.168.0.3 = DNS1.

Is there something else I need to set up?

This thread was automatically locked due to age.

Parents

0 BAlfson over 16 years ago

Is your client an Apple computer? There is a documented issue with Apple's use of names ending in ".local" and DNS.
Cancel
Vote Up 0 Vote Down

Cancel
0 wyocowboy over 16 years ago in reply to BAlfson

The vpn client is Windows xp sp3. I have tried the FQDN and just the host name of the DNS server and neither one resolved. The DNS server works with Win2k, XP and Linux clients.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to wyocowboy

Are there any relevant packets block in the packet filter live log?
Cancel
Vote Up 0 Vote Down

Cancel
0 wyocowboy over 16 years ago in reply to BAlfson

Are there any relevant packets block in the packet filter live log?

No, only port 137 UDP stuff. In the meantime, I have connected Wireshark on the DNS server side of ASG and I can see the pings come through when I use the DNS server IP address, showing the assigned VPN pool address as the source.

Pinging it by name reveals that the DNS request is not being forwarded/relayed to the DNS server by ASG.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to wyocowboy

Strange. Is there anything in the Intrusion Protection log?
Cancel
Vote Up 0 Vote Down

Cancel
0 wyocowboy over 16 years ago in reply to BAlfson

Strange. Is there anything in the Intrusion Protection log?

No, nothing.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 16 years ago in reply to wyocowboy

What happens with NSLOOKUP when you tell it to use your dns server?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 wyocowboy over 16 years ago in reply to BarryG

What happens with NSLOOKUP when you tell it to use your dns server?

Barry

Assuming you mean trying with the pptp client,

"Can't find server name for address 192.168.0.3: Timed out"
Cancel
Vote Up 0 Vote Down

Cancel
0 wyocowboy over 16 years ago in reply to wyocowboy

FWIW, I changed over to L2TP over IPsec and am seeing the same issue: I can ping the DNS server by IP address, but ASG does not forward DNS requests to the DNS server.
Cancel
Vote Up 0 Vote Down

Cancel
0 wyocowboy over 16 years ago in reply to wyocowboy

Since no dropped DNS packets were showing in the packet filter live log, I ran tcpdump on the ASG, tracing on interface ipsec0 shows that the DNS standard query A from the L2TP client is seen by the ipsec0 interface, and that the client tries both DNS servers that are configured in Remote Access - Advanced.

These are the same servers that are configured in Network - DNS - Forwarders, and there are no allowed networks in the Network - DNS - Global, since my DNS servers are running Active Directory. According to the text on that tab, this should prevent clients from using the ASG as a recursive DNS resolver.

Does anyone out there have any ideas why ASG is not forwarding DNS requests for the remote access client?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 wyocowboy over 16 years ago in reply to wyocowboy

Since no dropped DNS packets were showing in the packet filter live log, I ran tcpdump on the ASG, tracing on interface ipsec0 shows that the DNS standard query A from the L2TP client is seen by the ipsec0 interface, and that the client tries both DNS servers that are configured in Remote Access - Advanced.

These are the same servers that are configured in Network - DNS - Forwarders, and there are no allowed networks in the Network - DNS - Global, since my DNS servers are running Active Directory. According to the text on that tab, this should prevent clients from using the ASG as a recursive DNS resolver.

Does anyone out there have any ideas why ASG is not forwarding DNS requests for the remote access client?
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data