Cannot resolve Front End firewall hostname

kevindd992002

I don't know what gives, but all my Windows clients have this behavior. I can:
ping www.google.com
And underneath the ping resolves an IP address for a real public www.google.com - somehow ordinary programs that want name resolution do it OK.

But if I
nslookup www.google.com
Somehow nslookup always sticks on the domain name suffix/es and tries for www.google.com.mycompany.example.com.
So in nslookup I always put the root domain dot at the end:
nslookup www.google.com.
A quick search found this Microsoft article on how their nslookup works: nslookup www.google.com

Nslookup will always devolve the name from the current context. If you fail to fully qualify a name query (that is, use trailing dot), the query will be appended to the current context. For example, the current DNS settings are att.com and a query is performed on www.microsoft.com; the first query will go out as www.microsoft.com.att.com because of the query being unqualified. This behavior may be inconsistent with other vendor's versions of Nslookup, and this article is presented to clarify the behavior of Microsoft Windows NT Nslookup.exe

Ping works in every situation as it seems that it does not work the same way as nslookup.

That's exactly the behavior I notice in the network in my home. I expect it to work that way (it will append the suffix) as what I've read in several websites say the same thing you layed out in your reply.

This means that my test setup (the network diagram in dropbox) does not work right. Anybody have an idea what's going on here?

EDIT: Oh and by the way, the cause for this issue is definitely not because of the nslookup version as I've used the same test machine on both networks in question as to avoid component differences.

kevindd992002

BUMP!

johnpoz

So if you don't like your machine doing suffix search etc.. change the setup do do the correct order or not do it at all.

Still not grasping what you feel is not working? Again I will say this, members of domain should only point to authoritative dns for the AD domain.. Quite often that is the DC of the domain.. Pointing to pfsense be it running unbound, or dnsmasq, a bind derver, some other forwarder like your soho router, googledns directly is going to cause you grief.

Doing such a setup other than pointing to AD dns is for advanced use and need only..

kevindd992002

Sorry, I think you were referring to the first question in this thread. My main issue now (in this same thread) starts from reply # 18 and a few posts after that. Can you give that a quick read for me?

Thanks.

johnpoz

Don't be hijacking threads… Create your own.

kevindd992002

@johnpoz:

Don't be hijacking threads… Create your own.

This is MY thread and I thought my question is related to DNS, so I posted here. Anyway, I'll just transfer the contents of this thread to a new thread.