DNS problem?

Both myself and the company i work for are with the same ISP, a fairly small one, and we have both been assigned IPs in the same range i.e. 111.111.111.111/16.
My company has their IP assigned to the eth0 of the router and an internal address on eth1 of the router.
The router is configured to forward HTTP and RDP requests to one of our servers on the relevant port.
My works website is hosted on this server and the URL resolves to my works static IP.

I can browse all websites fine from home except one, my works website, which i cant access by IP address either.
I can however access my works website when using an anonymous proxy from home.

Ive just recently noticed as well that i cant RDP to the above mentioned server, even though port forwarding has been configured and "allow remote connections" has been enabled on the server.
I can RDP to the server from my work PC to the internal IP of the server.

Ive spoken with my ISP whos "IT Manager" is supposed to have called me back 2 weeks ago to resolve.

What could be the problem here? Im guessing its a problem with my ISPs DNS servers?

Any help would be appreciated cos im stumped.

Cheers

It might be worth flushing your local DNS cache? At least you know you will have a level playing field then.

Hey Hey,

It's definitely not a DNS problem if the same thing happens when you use the IP...

It sounds to me like it's the ISP's problem..

Here are some things that ISPs implement:

1. Partial "broadcast" filtering... Due to the age-old smurf attacks of the past... Many ISPs filter what they consider to be the broadcast address... However ISPs take the lazy man's way out in this process and just filter .255 addresses... This causes problems with ISPs (for example Rogers Cable) who supernet, making .255 a perfectly valid IP Address...

2. Filter specific ports... This is primarily 139 and 445... It's the ISPs way of limiting the spread of worms among their customers.... Port 25 has also made it's way onto that list with many ISPs to stop mass mailers... (This is generaly residential internet since there's a good chance businesses would require port 25)..

3. Filter internal requests... Some ISPs are offering "Business" filtering now.. I know someone who was recently scammed into this... They filter your ports from all other IPs on the same subnet... The public can access your business just fine but worms can't spread internally between customers... The problem with this that ISPs have failed to realize is that most businesses paying for a Cable / DSL business line are gong to be small businesses that are local... and they will probably want other local users to access their websites..

It sounds to me like #3 is occuring.... but I can't say for certain that they have that implemented... It could be that your office is performing that type of filtering to eliminate worms and such...

Could it be that the ISPs DNS servers have no host (A) records for these IPs in either the of the lookup zones?
I dont think that the ISP is implementing #3, this is a local, small fish ISP providing wireless internet to under 1000 people.

Try to connect using the IP address. If that doens't work either it's not DNS (as HTRegz already mentioned).

HTRegz is right if you can't connect to the ip address it has nothing to do with DNS. Typeing in the ip will completely bypass DNS.

a few handy tricks to troubbleshooting network/internet problems is:

Ping "hostname/IP"
Here you can see several things. The first you can see is if your DNS resolves the hostname to an ip address or not. Also if ICMP is allowed you can confirm that you can actually reach the ip/hostname in question.
If it fails to resolve the hostname, you have either made a typo or you have a DNS related problem.

If your DNS resolves the hostname as it should but you can't reach the IP address. Try a telnet "hostname/ip" "port". As an example if your trying to access your webserver the following line will show you if you have connectivity.

telnet www.domain.com 80
once connected the type the following line to query the server
gethtml

You will probably not be able see more than the webserver giving you a bad request - but from this we at least learned that it is responsive on the following port. If you are denied - you reach the server but the service isn't available. If you get a timeout it might be once again a typo or you can't actually reach the ip in question.


If you are sure the service is running, check if ICMP is allowed or not.

Then traceroute (tracert in windows if i remember correctly) "hostname/IP"

This will show the route you take across the internet. If you get a timeout on the way, the two most commen reasons are,

1) ICMP is not allowed
2) Routing problem

The easiest (not bulletproof though) way to determine if it a routing problem is to look at the hops. If it dies nowhere near the ip address you're trying to reach it might very well be buggy routing, if it dies one or two hops before you should reach the ip it is most likely ICMP.

Without more detailed information it could be everything from buggy routing to filtering, a typo in the firewall forward rule etc. So instead of assuming what is the problem i recommend eliminating the possibilities one by one and hopefully you will see the light along the way.

Since u can only see it through a proxy it might be some internal routing bug (an interface on your POP wrongly configured with the ip that now belongs to your company) or alike that gives you problemes.

Remember that if you find any evidence on ping/telnet/traceroute make sure to send it to your ISP. This tends either to help them locate the problem or better yet makes it very hard for them to ignore the error and write it off as "dumb" customer that actually has no problems.

When i try pinging my works external IP i get timeouts even though ICMP replies is enabled and vice versa pinging my home pc from work.
Ill get back onto my ISP.

Thanks for the help guys.

Better check your border router.... sounds like a mis-configure

This definately smells like a routing problem.
What were the results of your tracert from home? Where is it failing?
What were the results of your tracert from work? Where is it failing?

Since you are both on the same subnet, make sure both your home router's WAN interface and the work router's WAN interface have the correct ip settings. INCLUDING the subnet mask. You said that your work IP is statically configured, is that also true for your home connection?

BTW: From the sound of it, you have one IP address and that is port forwarded to a server on your internal network. I hope you understand that you really should not do this for public servers. This server should be a stand alone server and should sit in the DMZ behind a firewall. It is never a very good idea to serve from your internal LAN. If you need to access your corporate network from outside... use a VPN!

Quote:

---

Originally Posted by phishphreek

What were the results of your tracert? Where is it failing?

Since you are both on the same subnet, make sure both your home router's WAN interface and the work router's WAN interface have the correct ip settings. INCLUDING the subnet mask.

BTW: From the sound of it, you have one IP address and that is port forwarded to a server on your internal network. I hope you understand that you really should not do this for public servers. This server should be a stand alone server and should sit in the DMZ behind a firewall. It is never a very good idea to serve from your internal LAN. If you need to access your corporate network from outside... use a VPN!

---

I have to agree, this is where I would start looking. Especially if the routers are supplied by the ISP

Steve