Your assumptions and analysis are spot-on.  I neglected to mention the the 
problem is "solved" by rebooting the laptop.

As I said, I've been having a lot of problems with my WAN cutting out for 
short periods.  This would suggest that the m0n0wall DNS server becomes 
temporarily unavailable when it is dealing with a missing WAN, at which 
point it appears that W2K switches over to the secondary DNS server (on 
WAN) and never looks back.  I'm going to try some experiments to see if I 
can catch the m0n0wall DNS server napping.  It seems like there ought to be 
some way to convince W2K to revert to the primary DNS server...

I suppose the easiest "fix" is to simply not configure a secondary DNS 
server.  If the m0n0wall is out to lunch, WAN access ain't gonna work 
nohow.  An alternative would be to use my Linux server as the backup DNS 
server.

Thanks for your help.

NHA
---
Norman H. Azadian    Taegerishalde 13    CH-3110 Muensingen    Switzerland
norman at azadian dot ch      tel: +41 31 721 7855      fax: +41 31 55 898 55


Bryan K. Brayton wrote:
> Well, I'm assuming that your laptop is configured to use the m0n0wall
> lan IP as the first dns server, since you're getting the right IP
> address initially, and I'm guessing you have a secondary dns server
> configured on the laptop somehow too (either statically or by dhcp).
> 
> I don't think that nslookup will use the cached information from the
> windows dns resolver, so it does happen sometimes that nslookup will use
> your primary dns server, while your machine is actually using the
> secondary dns server.  This can lead to different results.
> 
> For reasons I'm not quite sure about yet, I've seen Windows machines
> switch to using the secondary dns server address.  I've usually been
> able to trace this to a temporary unavailability of the primary dns
> server.  If the scenario above is true, I'm not sure why your laptop
> would be able to access a wan dns server, but not the resolver on m0n0,
> except maybe if that process died or was unavailable/overloaded for some
> reason.  I'd sniff the machine's traffic to find out just what dns
> server it is using for normal dns lookups.
> 
> -Bryan
> 
>   
> 
>>-----Original Message-----
>>From: Norman H. Azadian [mailto:norman at azadian dot ch]
>>Sent: Monday, November 21, 2005 4:55 PM
>>To: m0n0wall at lists dot m0n0 dot ch
>>Subject: [m0n0wall] DNS problem
>>
>>Someone want to tell me how this can happen?
>>
>>
>>>C:\>nslookup mail.azadian.ch
>>>Server:  fw.azadian.ch
>>>Address:  192.168.3.3
>>>
>>>Name:    mail.azadian.ch
>>>Address:  192.168.3.10
>>>
>>>
>>>C:\>ping mail.azadian.ch
>>>
>>>Pinging mail.azadian.ch [80.238.205.32] with 32 bytes of data:
>>>
>>>Reply from 80.238.205.32: bytes=32 time<10ms TTL=63
>>
>>This is on my W2K laptop, which is connected to the mail server via
> 
> WLAN.
> 
>>mail.azadian.ch is DNS forwarded to mail server's internal address of
>>192.168.3.10 by m0n0wall-1.2.  When the laptop comes up, it runs
> 
> correctly
> 
>>for a while, meaning that both nslookup and ping use the internal
> 
> address.
> 
>>  Then it can't find the mail server, and I have the state shown
> 
> above.
> 
>>It
>>is perhaps important to note that my ADSL is going up and down like a
> 
> yo-
> 
>>yo
>>these days, due to either a bad modem or a bad line; I don't know
> 
> which
> 
>>yet.
>>
>>NHA
>>---
>>Norman H. Azadian    Taegerishalde 13    CH-3110 Muensingen
> 
> Switzerland
> 
>>norman at azadian dot ch      tel: +41 31 721 7855      fax: +41 31 55 898 55
>>
> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch
> For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch
>