Your assumptions and analysis are spot-on. I neglected to mention the the
problem is "solved" by rebooting the laptop.
As I said, I've been having a lot of problems with my WAN cutting out for
short periods. This would suggest that the m0n0wall DNS server becomes
temporarily unavailable when it is dealing with a missing WAN, at which
point it appears that W2K switches over to the secondary DNS server (on
WAN) and never looks back. I'm going to try some experiments to see if I
can catch the m0n0wall DNS server napping. It seems like there ought to be
some way to convince W2K to revert to the primary DNS server...
I suppose the easiest "fix" is to simply not configure a secondary DNS
server. If the m0n0wall is out to lunch, WAN access ain't gonna work
nohow. An alternative would be to use my Linux server as the backup DNS
Thanks for your help.
Norman H. Azadian Taegerishalde 13 CH-3110 Muensingen Switzerland
norman at azadian dot ch tel: +41 31 721 7855 fax: +41 31 55 898 55
Bryan K. Brayton wrote:
> Well, I'm assuming that your laptop is configured to use the m0n0wall
> lan IP as the first dns server, since you're getting the right IP
> address initially, and I'm guessing you have a secondary dns server
> configured on the laptop somehow too (either statically or by dhcp).
> I don't think that nslookup will use the cached information from the
> windows dns resolver, so it does happen sometimes that nslookup will use
> your primary dns server, while your machine is actually using the
> secondary dns server. This can lead to different results.
> For reasons I'm not quite sure about yet, I've seen Windows machines
> switch to using the secondary dns server address. I've usually been
> able to trace this to a temporary unavailability of the primary dns
> server. If the scenario above is true, I'm not sure why your laptop
> would be able to access a wan dns server, but not the resolver on m0n0,
> except maybe if that process died or was unavailable/overloaded for some
> reason. I'd sniff the machine's traffic to find out just what dns
> server it is using for normal dns lookups.
>>From: Norman H. Azadian [mailto:norman at azadian dot ch]
>>Sent: Monday, November 21, 2005 4:55 PM
>>To: m0n0wall at lists dot m0n0 dot ch
>>Subject: [m0n0wall] DNS problem
>>Someone want to tell me how this can happen?
>>>Pinging mail.azadian.ch [220.127.116.11] with 32 bytes of data:
>>>Reply from 18.104.22.168: bytes=32 time<10ms TTL=63
>>This is on my W2K laptop, which is connected to the mail server via
>>mail.azadian.ch is DNS forwarded to mail server's internal address of
>>192.168.3.10 by m0n0wall-1.2. When the laptop comes up, it runs
>>for a while, meaning that both nslookup and ping use the internal
>> Then it can't find the mail server, and I have the state shown
>>is perhaps important to note that my ADSL is going up and down like a
>>these days, due to either a bad modem or a bad line; I don't know
>>Norman H. Azadian Taegerishalde 13 CH-3110 Muensingen
>>norman at azadian dot ch tel: +41 31 721 7855 fax: +41 31 55 898 55
> To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch
> For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch