[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 591
  • Last Modified:

Cannot connect to internet using new Win2008 domain

i've created a new 2008 domain in our test lab.  the internet works from another domain in the lab, so connectivity out of the building is not the issue.  our security personnel state they are not blocking web traffic in the lab.  however, after creating the domain (dns is installed on the DC) i cannot access the internet from either the new DC or member server with the DC pointing to itself, much like normal 2003 domains i've created in the past.  i've removed the local firewalls from the servers, so that's not it.  however, when i put 4.2.2.2 for dns on the DC (root dns on the web) i can get out to the web.  i'm new to 2008, but aren't the root dns servers already configured by default and forwarding by default setup in DNS on a DC?  why would i need to set 4.2.2.2 for dns to resolve for the internet?
0
JodyBear
Asked:
JodyBear
  • 8
  • 6
  • 4
  • +2
4 Solutions
 
Sarang TinguriaSr EngineerCommented:
configuere 4.2.2.2 in your forwarder list
0
 
JodyBearAuthor Commented:
thanks, but why would that be needed?  i never needed that when i've created multiple 2003 domains.
0
 
Sarang TinguriaSr EngineerCommented:
Below link can answer most of your questions

http://support.microsoft.com/kb/291382

However, If your DNS queries are failing it might possible you have configuered none among Root hints and forwarders
0
Microsoft Certification Exam 74-409

VeeamĀ® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 
Sarang TinguriaSr EngineerCommented:
This Could also be helpful

A DNS server on a network is designated as a forwarder when the other DNS servers in the network are configured to forward the queries that they cannot resolve locally to that DNS server. By using a forwarder, you can manage name resolution for names outside your network, such as names on the Internet, which can improve the efficiency of name resolution for the computers in your network. For more information about forwarders and conditional forwarders, see Understanding Forwarders.


http://technet.microsoft.com/en-us/library/cc754941.aspx
0
 
JodyBearAuthor Commented:
that's some great information, thank you.  the confusing part however is i installed DNS during the dcpromo wizard, and haven't touched it.  the DC is pointing to itself, i double-checked that aready.  any idea why by default it won't go to the internet when it's already pointing to itself and i haven't touched DNS?  something new in 2008?
0
 
Mike KlineCommented:
On the forwarder tab on your server see if the Root hints if no forwarders box is checked (see screenshot below).

Also confirm that your root hints are listed and you can resolve names from them.

1
Thanks

Mike
0
 
JodyBearAuthor Commented:
i'm leaving for the day, but will doublecheck tomorrow morning.  thanks, i'll update this thread first thing in the morning.
0
 
Sarang TinguriaSr EngineerCommented:
Because DNS server without Forwarder or root hint will not have records for domain names outside your network(google.com or yahoo.com )

 When you configuere theese two (forwarders and root hints )the unresolved DNS queries will be forwarded to them by your local DNS server
0
 
sysreq2000Commented:
Yes that's perfectly normal for it to point to itself. It needs to point to itself for the internal and active directory functions, then you need to set up an external dns as a forwarder for outside addresses. So you're almost there, have the server point to itself, then in DNS properties under forwsrders put one of the sites mentioned, or you can use your ISP's DNS server as a forwarder, whichever you prefer.
0
 
JodyBearAuthor Commented:
so, i have to do that with 2008 now?  i didn't have to with 2003.
0
 
Seaton007Commented:
Run a traceroute to the internet domain name and see where it's failing.
0
 
sysreq2000Commented:
I believe 2003 was the same.
0
 
JodyBearAuthor Commented:
i'll test it.  thank you.  more tomorrow...
0
 
Sarang TinguriaSr EngineerCommented:
Check the setting in 2003 ...forwarders or root hints has to be there

Yes ...You need to configuere forwarders and root hints thats standard practice
0
 
JodyBearAuthor Commented:
ok.  i just created one DC for 2008 and a different new DC for 2003 as a test - 2 different VMs in the same lab.  the 2008 DC/domain, as before, cannot go to the internet after using dcpromo and ensuring DNS is installed.

however, as i thought i had done many other times in my own VM environment, creating a 2003 DC domain/VM and loading DNS in the same environment - i can go out to the internet with NO DNS changes/editing.  i didn't touch a thing. this is what i remembered doing in the past.  i pointed both DCs to themselves, only loaded DNS - did not touch DNS - and 2003 DC/domain goes to the web with no issues - 2008 DC/domain does not.

i've attached the warning i get when promoting/adding DNS with the 2008 DC - i get no such warning with the 2003 domain - never had.

can anyone tell me what has changed with 2003?  and what would be the best practice (for my own info, don't wanna just use arbitrary 4.2.2.2 just cause it works) to use to set the forwarder for 2008?
2008-warning.docx
0
 
sysreq2000Commented:
Not sure why your 2003 server works on it's own, it's been too long, I'll have to try that. :)

I would say best practice is to use your ISP's DNS rather than the free ones. Most ISP's will give you at least two servers to use as primary and secondary, then you can add 4.2.2.2 and/or 8.8.8.8 to the bottom of the list of forwarders just in case.
0
 
JodyBearAuthor Commented:
mkline - understood, in my instance it is looking for ".local", or "."  gotcha and can ignore.

again, understanding i don't have a DNS resolving problem when creating a new 2003 DC/DNS and resolving to the internet with no editing DNS (never had to before, which confused me when creating 2008 root DC/DNS and trying to go internet) - what would be the "best practices" to set my 2008 DNS resolver to?   8.8.8.8 the common one on most new domains would use?  4.2.2.2?  looking for best practices for my own career type of thing, and to continue my studying for 2008 (almost ready to take the tests to upgrade my MCSE).
0
 
Sarang TinguriaSr EngineerCommented:
How we should Configuere DNS on our DC :-->

Every DNS server should Point to its own IP as a primary DNS and DNS located in remote site as a secondary DNS in TCP/IP properties
All the unused NIC's to be disabled
Valid DNS Ip from ISP to be configuered in DNS forwarders Do not configuere local DNS in forwarders
Public DNS IP's Should not be used at any NIC Card except Forwarders
Domain Controllers should not be multi-homed
Running VPN server and RRas server makes the DC multihomed refer http://support.microsoft.com/default.aspx?scid=kb;en-us;272294


DNS best practices
http://technet.microsoft.com/en-us/library/cc778439(v=WS.10).aspx

Checklist: Deploying DNS for Active Directory
http://technet.microsoft.com/en-us/library/cc757116(v=ws.10)
0
 
Mike KlineCommented:
8.8.8.8. is very common because it is google, what we do is forward to two BIND servers that our  Unix team runs but that is usually not done in smaller organizations.

Thanks

Mike
0
 
JodyBearAuthor Commented:
2008 apparently must have it's DNS configured.  2003 did not - it was good by itself with no additional configuration.  thanks for the help - i've included multiple people on solution as more than one offerred similar answers - to be fair.  thank you everyone.
0
 
Mike KlineCommented:
glad you got it working....have a great weekend

Thanks


Mike
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 8
  • 6
  • 4
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now