The_cobra666's questions

I'm stuck in solving the following problem.

We have 2 domain and DNS controllers. Everything works like it should, except for something very weird.

On the DNS servers we have 2 extra Primary AD integrated zones to make sure everybody uses Google safe search.

If we use the 1st DNS server, www.google.com redirects perfectly to forcesafesearch.google.com, like it should. However, when using the second DNS server, it doesn't resolve. Yet, the zone is transfered from server 1 to server 2.... they have both the exact same settings....

What have I tried:

-Flush cache on clients and servers. Clean up old records, update the server data for the master DNS servers. Rebooted the servers, restarted the DNS service... etc... I'm really starting to get out of options.

What it should do:

C:\WINDOWS\system32>nslookup
Default Server:  dom1.none.local
Address:  192.168.2.77

> www.google.com
Server:  dom1.none.local
Address:  192.168.2.77

Name:    forcesafesearch.google.com
Address:  216.239.38.120
Aliases:  www.google.com

and what server 2 does:

C:\WINDOWS\system32>nslookup
Default Server:  dom2.none.local
Address:  192.168.2.79

> www.google.com

When you lookup forcesafesearch.google.com on server 2, it resolves just fine to the correct ip address...

I'm puzzled by this, because everything else works just fine.

The zone name is: www.google.com. then a DNAME record linking to forcesafesearch.google.com.

It's all text book.. yet for some unknown reason, it doesn't work :(

Setup: both the servers are running 2012R2 latest version fully up2date.

//more info:

    C:\WINDOWS\system32>nslookup
Default Server:  dom2.none.local
Address:  192.168.2.79

> www.google.com
Server:  dom2.none.local
Address:  192.168.2.79

Name:    www.google.com

> google.com
Server:  dom2.none.local
Address:  192.168.2.79

Non-authoritative answer:
Name:    google.com
Addresses:  2a00:1450:400c:c04::64
          64.15.124.119
          64.15.124.123
          64.15.124.120
          64.15.124.121
          64.15.124.117
          64.15.124.116
          64.15.124.118
          64.15.124.122

> forcesafesearch.google.com
Server:  dom2.none.local
Address:  192.168.2.79

Non-authoritative answer:
Name:    forcesafesearch.google.com
Address:  216.239.38.120

>

and from the log:

18/03/2016 14:39:46 0B38 PACKET  0000008C13C3C1A0 UDP Rcv ::1             0012   Q [0001   D   NOERROR] A      (3)www(6)google(2)com(11)none(5)local(0)
UDP question info at 0000008C13C3C1A0
  Socket = 524
  Remote addr ::1, port 55912
  Time Query=3300, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x0031 (49)
  Message:
    XID       0x0012
    Flags     0x0100
      QR        0 (QUESTION)
      OPCODE    0 (QUERY)
      AA        0
      TC        0
      RD        1
      RA        0
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    0
    NSCOUNT   0
    ARCOUNT   0
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(3)www(6)google(2)com(11)none(5)local(0)"
      QTYPE   A (1)
      QCLASS  1
    ANSWER SECTION:
      empty
    AUTHORITY SECTION:
      empty
    ADDITIONAL SECTION:
      empty

18/03/2016 14:39:46 0B38 PACKET  0000008C13C3C1A0 UDP Snd ::1             0012 R Q [8385 A DR NXDOMAIN] A      (3)www(6)google(2)com(11)none(5)local(0)
UDP response info at 0000008C13C3C1A0
  Socket = 524
  Remote addr ::1, port 55912
  Time Query=3300, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x0076 (118)
  Message:
    XID       0x0012
    Flags     0x8583
      QR        1 (RESPONSE)
      OPCODE    0 (QUERY)
      AA        1
      TC        0
      RD        1
      RA        1
      Z         0
      CD        0
      AD        0
      RCODE     3 (NXDOMAIN)
    QCOUNT    1
    ACOUNT    0
    NSCOUNT   1
    ARCOUNT   0
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(3)www(6)google(2)com(11)none(5)local(0)"
      QTYPE   A (1)
      QCLASS  1
    ANSWER SECTION:
      empty
    AUTHORITY SECTION:
    Offset = 0x0031, RR count = 0
    Name      "(11)none(5)local(0)"
      TYPE   SOA  (6)
      CLASS  1
      TTL    3600
      DLEN   40
      DATA   
        PrimaryServer: (4)dom2[C031](11)none(5)local(0)
        Administrator: (10)hostmaster[C031](11)none(5)local(0)
        SerialNo     = 161741
        Refresh      = 900
        Retry        = 600
        Expire       = 86400
        MinimumTTL   = 3600
    ADDITIONAL SECTION:
      empty

18/03/2016 14:39:46 0B38 PACKET  0000008C13D4E1F0 UDP Rcv ::1             0013   Q [0001   D   NOERROR] AAAA   (3)www(6)google(2)com(11)none(5)local(0)
UDP question info at 0000008C13D4E1F0
  Socket = 524
  Remote addr ::1, port 55913
  Time Query=3300, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x0031 (49)
  Message:
    XID       0x0013
    Flags     0x0100
      QR        0 (QUESTION)
      OPCODE    0 (QUERY)
      AA        0
      TC        0
      RD        1
      RA        0
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    0
    NSCOUNT   0
    ARCOUNT   0
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(3)www(6)google(2)com(11)none(5)local(0)"
      QTYPE   AAAA (28)
      QCLASS  1
    ANSWER SECTION:
      empty
    AUTHORITY SECTION:
      empty
    ADDITIONAL SECTION:
      empty

I've got some weird problem and I'm out off options. The situation:

When connecting from my mac to the VPN server (Windows Server 2003 R2) with L2TP PSK, everything works like it should.

However, when I connect from a Windows PC, nothing happens. it spits out error 809 and sometimes 789. Now I know that my ports are OK, since the mac can connect without any problems.

It's the same for: XP, Vista SP2 and 7. None can connect. If I connect to the VPN server directly (to the internal IP instead of WAN from the router), it connect's without a problem. Connecting using PPTP works... now if only L2TP would work thank you very much Windows!

I have checked the counters on my linux router with iptables -L -nv and they do not raise when connecting. Not on ACCEPT and not on DROP. Only when connecting from the mac.

I've found the guide from Microsoft to enable: AssumeUDPEncapsulationContextOnSendRule in the registery. I have set it to "2", on the server and client. Still no go. After that registery key it started giving me error 789 instead of 809. The IPSEC services are running on the client and server.

Is there anyone that ppleease can help me with this! I've been working on this for 2 days and I'm out of options.

Thanks!

//edit: see solution below. This is ONLY for windows clients trying to connect to a VPN server behind a NAT router!

I'm setting up port forwarding for an L2TP VPN connection to the local Windows 2003 VPN server. The router is a simpel Debian machine with iptables. The VPN server works perfect. But I cannot log in from the WAN. I'm missing something.

The VPN server is using a pre-shared key (L2TP) and give's out an IP in the range: 192.168.3.0. Local network range is 192.168.2.0/24

I added the route: with route add -net 192.168.3.0 netmask 255.255.255.240 gw 192.168.2.13 (the vpn server)

iptables -t nat -A PREROUTING -p udp --dport 1701 -i eth0 -j DNAT --to 192.168.2.13
iptables -A FORWARD -p udp --dport 1701 -j ACCEPT
iptables -t nat -A PREROUTING -p udp --dport 500 -i eth0 -j DNAT --to 192.168.2.13
iptables -A FORWARD -p udp --dport 500 -j ACCEPT
iptables -t nat -A PREROUTING -p udp --dport 4500 -i eth0 -j DNAT --to 192.168.2.13
iptables -A FORWARD -p udp --dport 4500 -j ACCEPT
iptables -t nat -A PREROUTING -p 50 -j DNAT --to 192.168.2.13
iptables -A FORWARD -p 50 -j ACCEPT
iptables -t nat -A PREROUTING -p 51 -j DNAT --to 192.168.2.13
iptables -A FORWARD -p 51 -j ACCEPT

The whole iptables script is (without the line's from above):

    echo 1 > /proc/sys/net/ipv4/ip_forward
    echo 1 > /proc/sys/net/ipv4/tcp_syncookies

            #Flush table's
            iptables -F INPUT
            iptables -F OUTPUT
            iptables -F FORWARD
            iptables -t nat -F

            #Drop traffic
            iptables -P INPUT DROP
            iptables -P FORWARD DROP
            iptables -P OUTPUT ACCEPT

            #verkeer naar buiten toe laten en nat aanzetten
            iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
            iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
            iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

            #RDP forward voor windows servers
            iptables -t nat -A PREROUTING -p tcp --dport 3389 -i eth0 -j DNAT --to 192.168.2.10:3389
            iptables -A FORWARD -p tcp --dport 3389 -j ACCEPT
            iptables -t nat -A PREROUTING -p tcp --dport 3340  -i eth0 -j DNAT --to 192.168.2.12:3340
            iptables -A FORWARD -p tcp --dport 3340 -j ACCEPT

            #toestaan SSH verkeer
            iptables -t nat -A PREROUTING -p tcp --dport 22 -i eth0 -j DNAT --to-destination 192.168.2.1
            iptables -A INPUT -p tcp --dport 22 -j ACCEPT

            #toestaan verkeer loopback
            iptables -A INPUT -i lo -j ACCEPT

            #toestaan lokaal netwerk
            iptables -A INPUT -i eth1 -j ACCEPT

            #accepteren established traffic
            iptables -A INPUT -i eth0 --match state --state RELATED,ESTABLISHED -j ACCEPT

        #droppen ICMP boodschappen
        iptables -A INPUT -p icmp -i eth0 -m limit --limit 10/minute -j ACCEPT
        iptables -A INPUT -p icmp -i eth0 -j REJECT

    ifconfig eth1 192.168.2.1/24
    ifconfig eth0 XXXXXXXXXXXXX/30
    ifconfig eth0 up
    ifconfig eth1 up
    route add default gw XXXXXXXXXXXXXXXXXXX
    route add -net 192.168.3.0 netmask 255.255.255.240 gw 192.168.2.13

The script below does not work without iptables -P INPUT, OUTPUT, FORWARD ACCEPT. I must be missing a rule but can't find it. I'm new to iptables, so I'm hoping one of the geniuses here could help me out. ETH0 is the WAN and ETH1 is LAN.

//edit 2 forwarding is enabled in sysctl.conf.

#downen network interfaces

ifconfig eth0 down
ifconfig eth1 down

#droppen traffic
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -t nat -F

#verkeer naar buiten toe laten en nat aanzetten
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

#RDP forward voor windows servers

iptables -t nat -A PREROUTING -p tcp --dport 3389 -i eth1 -j DNAT --to destination 192.168.2.10
iptables -t nat -A PREROUTING -p tcp --dport 3340 -i eth1 -j DNAT --to destination 192.168.2.12

#toestaan SSH verkeer
iptables -t nat -A PREROUTING -p tcp --dport 22 -i eth0 -j DNAT --to destination 192.168.2.1
iptables -t nat -A PREROUTING -p udp --dport 22 -i eth0 -j DNAT --to destination 192.168.2.1

#toestaan verkeer loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#toestaan lokaal netwerk
iptables -A OUTPUT -o eth1 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT

#netwerk kaarten aanzetten
ifconfig eth0 XXXXXXXX
ifconfig eth1 192.168.2.1/24
route add default gw XXXXXXXXXX

ifconfig eth0 up
ifconfig eth1 up

I've got a SBS 2008 server that is setup and running great. Exchange works, fileserver everything a ok. VPN also runs but.. nobody is able to connect to it.

The router is a WRT54G from Linksys. It has VPN passthrough enabled. Port 1179 is forwarded to the server. When the build in client off Vista connects, it quits on "checking user and pass" with error 619.

In the log (on the server) it says: "The following error had occoured in the module for the point to the point protocol on port VPN2-127, username: XXXX. The RADIUS-(dutchword) kenmerk, Tunnel Type for this user is incorrect.

The error ID is: 20255, source: RemoteAccesss.

Anybody who knows what this is?

Goodmorning, afternoon, evening, night? :D

Recently I was asked to install a SBS 2008 server. Never had any experience with the OS, but was suprised how easy microsoft made installing SBS with all the wizards. Thumbs up for that!

Okay, the situation:

We have 2 locations. One main location, the office and the remote office. The server is located in the office. It will be used for files and exchange. Nothing more.

I already got exchange to work, but now I'm stuck with accessing the files in the remote office. I personally never configured a VPN, other then OpenVPN under linux. I noticed SBS also has a VPN server installed.

When I activate the VPN server, it installes and is configured (long live the wizard). When I'm connecting to it via XP or windows 7, the client quits when building the tunnel. It connects, authenticates and then quits.

I really don't have a clue what's going wrong or if this is even the right sollution to access the files on the server from the remote office. Any advice on this, would be great.

Thanks and greetings from Belgium!

I've got a weird problem, (like always :p )

Okay: Situation: Windows 2003 domain with XP clients. With a GPO I'm running a VBS script on login to map a few drives. This works great on XP, but not on Vista. If I manually run the script after the user has logged on, it works. So I know the script works on Vista, it just doesn't run via the GPO. The user has admin privileges.

I also have the same problem on Windows 7 RC1. So it must be related.

The script:

 on error resume next
Dim objNetwork
Dim strDriveLetter, strRemotePath, strUserName
strDriveLetter = "Z:"
strRemotePath = "\\Onsgeluk.ons_geluk.local\Profieldoc"
Set objNetwork = WScript.CreateObject("WScript.Network")
strUserName = objNetwork.UserName
objNetwork.RemoveNetworkDrive "Z:"
objNetwork.MapNetworkDrive strDriveLetter, strRemotePath _
& "\" & strUserName
objNetwork.RemoveNetworkDrive "X:"
objNetwork.MapNetworkDrive "X:" , "\\Onsgeluk.ons_geluk.local\Data"
objNetwork.RemoveNetworkDrive "Y:"
objNetwork.MapNetworkDrive "Y:" , "\\Onsgeluk.ons_geluk.local\Mappen\hoofdverpleging"

Does anyone have a clue?

Thanks in advance guys (and girls)

ps: sorry for my bad english!

I've got a very strange problem. On the net I can only find problems with Server 2003 pc's, that reboot instead of shutting down, but in my case... (go figure) it does the opposite. When I choose to reboot, the system shutdown.

Yes I am sure I used the reboot button. It happens via start ==> reboot and it happens when clicking on the reboot button when the update's have been installed.

Nothing changed to the system's hardware. Only update's have been installed on the system.

I did notice something odd in the logs when rebooting: Description: Timed out sending notification of target device change to window of "C:\WINDOWS\Explorer.EXE" KB: http://support.microsoft.com/kb/924390 They talk about a removable drive, but in my case, it's explorer.exe :s it appears 4 times.

OS: Windows Server 2003 R2. Services: AD, DNS, DHCP, WSUS.

Thanks in advance!

Greetings from Belgium Shane