Routing Active - Only ping and nslookup work

[Colin Higbie]

Please help. I'm frustrated and desperate.

I am running a Windows 2000 Server on my small network (about 10 machines,
currently testing on 3 including the server). The server computer is also
connected to the Internet through a second NIC. I activated Routing and turned
on NAT. The server was already running DHCP and DNS, so I'm not sure what
those settings should be in the Routing configuration. I have tried turning
both on and off with no apparent effect.

My application is to connect my server to a T-1 based Internet connection to
also serve as a modest firewall. I want to use private IP addresses inside the
network. The server is Windows 2000 Server with Active Directory for printer
and folder sharing. The rest of the systems are Windows XP Pro workstations.

The client computers on the network can successfully use nslookup and ping to
obtain IP address of external computers and to ping them. I can also tracert
those IP addresses (but not by name). If I try to open a web page or access
e-mail or open Instant Messenger, all immediately fail as if they have no
connection to the Internet. The server/router can successfully open web pages
with no problem. Why would it allow those protocols to pass through
successfully, but fail when the client systems try to open a web site or do
anything else of use?

If I replace the server with a standard Windows XP Pro workstation running
Internet Connection Sharing, all systems work perfectly and access the
Internet with no problem, so I am confident the problem lies with how I've
configured the server, not anything on the client machines. All of the
settings in Routing are the defaults that it created when I first activated
it. Routing is set to public Internet over the Internet access (via Wi-Fi USB)
and to private for the NIC that connects to the rest of the network. I looked
at the properties for all of the other Routing settings and everything looked
sensible, but I admit that I'm not sure I'd know a problem if I looked right
at it. I have certainly not told it anywhere only to allow ping and nslookup
and tracert to go through, while blocking all http and other relevant traffic.

I have never used Routing before, so I assume my problem comes from something
stupid I'm doing. I suspect it may have to do with my also running DHCP and
DNS servers on the same system. I didn't see anything about that, either pro
or con in the online help. It makes me think that maybe its supposed to just
be common sense not to do that? But I want those services for their options
(DHCP needed for scopes and DNS needed for Active Directory).

Please help. How do I make this work? What am I doing wrong?

Thank you,
Colin

 

[Janice]

Sounds like the problem is dns, you can get on the
internet but not resolve names. Since you are using
Active Directory, your client pc's should be using the w2k
server's address as their DNS server. If not, change your
DHCP options. In your server's DNS configuration there is
an option to have it go out to another DNS server on the
Internet to resolve what it doesn't kwow about. By
default it only knows about the computers connected to it
via Active Directory registrations. Go to Adminstrative
Tools>DNS. Right click on the DNS server and select
properties. Go to the tab Forwarders. Check the box to
use forwarders and put in the DNS resolvers of your ISP.

 

[Colin Higbie]

That option is grayed out. Is that a symptom of a problem?

But also, if I just use nslookup on the client machines, it works. Isn't that
a pure test and a result that shows DNS is working? Also, if I have already
resolved the IP address (through nslookup or on another machine or I just know
the IP #) and enter that in the web URL, it still fails to open the web page.
It's more like the whole HTTP protocol is refused (and POP3, and FTP, and
whatever AOL Instant Messenger uses, etc.). Like I said originally, only ping
and nslookup (for DNS resolution from the command line, none from a web
browser) work.

Anything else I can try?

Thanks for any and all help,
Colin

 

[Colin Higbie]

Also, when I deleted the . at the top of my tree, the Enable forwarders option
on the Forwarders tab is still grayed out.

I haven't damaged my Active Directory/DNS by removing that have I? It gave me
warnings about how it was AD integrated and would be removed from all DNS
servers... Am I OK?

Also, I may have been wrong before - I had DHCP also assigning the external,
Internet-based DNS servers to all its clients (as secondary to itself).
Perhaps the only reason I was able to browse the web before when only running
AD, DHCP, and DNS (and not the routing service) was because the clients were
able to use those external DNS servers. Therefore, perhaps I was wrong to say
that the DNS was working. However, even when running Routing and assigning
private IP's (192.168.x.x), nslookup did successfully return IP#'s. How could
that have happened without DNS working?

Thanks,
Colin