Terminal Server & Broken Internet

Hey all,

Have a bit of an issue at the moment. Hoping someone has a few ideas or suggestions. I have googled around but cannot find anything that is specifically helpful.

Have a client with an exchange server and terminal services installed on another server. Exchange is Windows Server 2003 SBS SP1, Terminal Server is Windows Server 2003 R2 Standard SP2. Exchange is AD.

Network layout is [internet-router-internal] so i can guarantee the problem is solely on the Terminal Server and nowhere else. Quite simply, the internet does not work, Specifically, a web browser does not work. Internet is running as expected on the Exchange server; can browse, telnet/ftp out, ping etc.

On the Terminal Server i can ping any IP address on the interweb and DNS is resolving quickly and normally. In effect the internet is there. Launch Internet Explorer go to www.google.com and Status bar says Done and nothing is shown on screen, or it continues to 'load' the page endlessly with other sites. IE Enhanced Security Configuration (ISC) is installed. However i have added every site i have tried to test to trusted sites, enabled every single option for trusted sites. No avail. I have even uninstalled the ISC (without reboot) and the same problem.

Perhaps it is the browser itself, so i installed the latest version of IE from MS Website. Same issue. Lets try another browser, Firefox is always good..... well, when i try to browse there is a pause as if it is trying to resolve the name then it starts to download a file called something like 4cc43f13 which is an "Application/Octect-Stream" and i can either save it open the file but that is it.

So I am a little dumbstruck and not quite sure what my next option is considering i fell i have removed everything that could potentially cause this and every other workstation/server has no issue like this. Please note that the Exchange server also has ISC installed but has no problems.

Any ideas guys??

I will post links and info as i come across it whilst researching.

Cheers

The SBS limits licensing to 1 Terminal Server User at a time...maybe the SBS is denying access someway...depending on the browsers\computers gateway permissions

definately a permissions thing...check group\ user permissions

could even be a gateway to gateway thing

guessing........just ideas

MLF



MLF

The terminal server is 2003 standard, not SBS. Multiple users can logon and use the applications installed on terminal services etc so i dont think it is a licensing or permissions issue, particularly when logged onto the console session with domain administrator still does not allow normal internet browsing or ftp hookups. Bit of a mystery it seems.

Thanks MLF :)

Ok, let's go back to basics here first.

Just to make sure I have it right the Exchange Server can access the internet and use IE ok? The Terminal Server can't?

Ok, open up a command prompt on Exchange and type ipconfig /all and post the results. What is the default gateway? And what does the default gateway correspond to, is it the router?

Do the same on the Terminal Server.

I'm going to assume the default gateway on the Exchange Server is the router.

Next question, does the Exchange Server have a proxy server installed.
In IE, go into Tools, Internet Options, Connections, LAN Settings and see if it is using a proxy server, maybe set to the IP Address of the Exchange Server or localhost on port 8080.

Next check if the Terminal Server can ping the Exchange Server.

Try setting the default gateway to either the router (if this is ok for your network otherwise) or the IP Address of the Exchange Server.

OR, if there is a proxy on the Exchange Server, try setting the proxy to the IP Address of the Exchange Server on port 8080 in IE.

Quote:

---

Just to make sure I have it right the Exchange Server can access the internet and use IE ok? The Terminal Server can't?

---

Yep, just to reiterate, the only problem i have with the entire network is the terminal server cannot browse the web.
-------------------------------------------------------------------------
IPConfiguration on Exchange (SBS2003);
External Facing NIC
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 202.61.x.x
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . : 202.61.x.x
DNS Servers . . . . . . . . . . . : 192.168.0.2
Primary WINS Server . . . . . . . : 192.168.0.2

Internal Facing NIC
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.0.2
Primary WINS Server . . . . . . . : 192.168.0.2

IPConfiguration on Terminal Server (Std2003)
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.2
DNS Servers . . . . . . . . . . . : 192.168.0.2

(Above should answer all questions re gateway etc)
-------------------------------------------------------------------------

Definitely no Proxy or ISA server running. If i set the terminal server to use the SBS Server as a proxy, when browsing the web all i get is the "mycompany" internal webpage.

Quote:

---

Next check if the Terminal Server can ping the Exchange Server.

---

Yes, this is a definite. Everything seems to be fine and working ok. I can even ping externally from the terminal server and resolve host names via SBS server as you would expect.

It almost seems like it is a browser issue ?? IE has been updated to the latest version and a different browser has been tried as mentioned in my first post.

Thanks for the feedback guys.

CTO

Ok, quick question - what is the IP Address of the router?

Also, if you do a tracert www.google.com - what do you get, can you post results.

I'm guessing the IP Address of the router is: 202.61.x.x

Just to confirm that the external NIC on the Exchange Server is connected to a router and not directly to the Internet?

Ok...from what I've read, on the server that we cannot browse the web on, we can ping and resolve DNS via command prompt...just not getting pages to load.

First thring I would try, is remove the Enhanced security crap on IE....Try that...if that doesn't work, install firefox or something and see and if we can browse the web via something other than IE.

That will at least help us narrow down the problem.

He already tried using FF.

Just woke up, trying to get my coffee so I am a little fuzzy...

Just to clarify, what you are saying is

Internet ----- router ------ ( 202.61.x.x)Exchange(192.168.0.2) ------- (192.168.0.3)Terminal Server

Where Terminal Server is using Exchange Server as DNS server and default gateway ?

is the SBS a standard or premium...basically are you using ISA???

What version?

MLF

Quote:

---

First thring I would try, is remove the Enhanced security crap on IE....Try that...if that doesn't work, install firefox or something and see and if we can browse the web via something other than IE.

---

This was already covered and mentioned, tried and done.

Quote:

---

is the SBS a standard or premium...basically are you using ISA???

---

I cant seem to find anything to indicate premium version however it does not say standard anywhere either. No there is no proxy or ISA server running, as i have already mentioned.

Quote:

---

Also, if you do a tracert www.google.com - what do you get, can you post results

---

Results from the terminal server (The problematic server)
------------------------------------------------------------------------
Tracing route to www.l.google.com [72.14.253.99]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms [exchange server name].[domain name].com.au.local [192.168.0.2]
2 1 ms 1 ms 1 ms 202-61-227-5.static.dft.net.au [202.61.x.x]
3 10 ms 10 ms 9 ms bdr0.per.dft.net.au [202.61.225.65]
4 9 ms 10 ms 9 ms ge0-1.core.dft.net.au [202.61.224.178]
5 8 ms 9 ms 10 ms VLAN214.o6ssc76fe.optus.net.au [61.88.166.113]
6 234 ms 226 ms * 203.208.148.73
7 228 ms 246 ms 271 ms ge-0-0-0-0.laxow-dr2.ix.singtel.com [203.208.171
.66]
8 288 ms 226 ms 267 ms 203.208.169.154
9 261 ms 242 ms 245 ms 216.239.43.126
10 254 ms 243 ms 244 ms 216.239.46.203
11 273 ms 297 ms 253 ms 209.85.250.67
12 249 ms 287 ms 242 ms 72.14.233.14
13 244 ms 247 ms 263 ms po-in-f99.google.com [72.14.253.99]

Trace complete.
------------------------------------------------------------------------

Quote:

---

Where Terminal Server is using Exchange Server as DNS server and default gateway ?

---

Correct. The Exchange server is the DHCP/DNS/Domain Controller as well as exchange. It is the "go to" server for all the workstations. It also hosts the company data. The Terminal Server is specifically for Terminal Services and is not running anything additional to this. I dont think it should be configured differently to any other working client, but could be wrong here.

:) Cheers guys. Thanks for all your input.

CTO

Try one more thing for me?

On the Terminal Services Server, try using telnet:

telnet mail1.eircom.net 25

See if you can connect.

This will give us basic internet activity.

Have you any software firewall running on the Terminal Services Server?

Not that I can help, but just a few more things to clarify:

So, It is set up in what Microsoft calls a server environment. Because of this, and the fact you are not running ISA, you will be running and doing the NAT through Routing And Remote Access (RRAS) and the Basic Firewall on the Exchange Server.

1) What was working and what was changed when you noticed the problem?

2) You mentioned other clients. They have access to the Internet using web browsers with no problems?

3) What policy for the Basic Firewall are you using ( Domain? )

4) What do the logs for RRAS and the Exchange Server Basic Firewall show?

Quote:

---

Originally Posted by IKnowNot

3) What policy for the Basic Firewall are you using ( Domain? )

---

I think you just hit on the problem!!

If the Exchange Server is your main Domain Controller then each client logs on to the domain provided by exchange server and is registered. Each user is provided with Internet Access privlidges.

So if the Terminal Server is not part of the domain but using the correct gateways etc, then a logged on user will not have the correct privlidges within the domain of the Exchange Server.

Quote:

---

On the Terminal Services Server, try using telnet:

telnet mail1.eircom.net 25

---

Connected immediately "220 mail07.svc.cra.dublin.eircom.net ESMTP" response.

Quote:

---

So if the Terminal Server is not part of the domain but using the correct gateways etc, then a logged on user will not have the correct privlidges within the domain of the Exchange Server.

---

The terminal server IS part of the domain. I also dont believe it to be a permissions level problem, but i will believe anything at this stage.

NAT/Firewall on exchange server has absolutely nothing fancy and nothing that would cause this problem.

As you can see the Terminal Server does have internet connectivity. When using Internet Explorer the status bar displays "website found, waiting for page to load" and with www.google.com in particular (fast loading) the status bar displays "done" - as it finishes loading the page it looks like something was loaded but just a blank page.

----
Just noticed something interesting. Keep in mind what i said about the microsoft page loading forever and the google page loads but displays nothing. When i browse to www.antionline.com i get the IE This page cannot be displayed page;
Most likely causes:
You are not connected to the Internet.
The website is encountering problems.
There might be a typing error in the address.

I cannot ping www.antionline.com but can ping www.google.com and mail.bigpond.com (Biggest ISP Here)

I can open this FTP site: ftp://isr.serveftp.net/
I can download files from this FTP server. However, cannot upload files. It just hangs with the file copy/upload dialog box going nowhere. (Yes i have authenticated on the FTP server fine as i can upload files from any other workstation/server in the entire network. )

So with all of that in mind..... go figure? YES i have internet on the terminal server because i CAN download files from the ftp server. The FTP server is in no way logically or phycically local to this network.

I say again... go figure :p

Thanks for all your input with this again guys - most appreciated.

Frustrated CTO

Ok, well we can say that without a doubt the Terminal Services Server does have internet connectivity.

So I'm guessing that it is either a browser or a DNS problem.

Can you add 159.134.237.6 as your primary DNS Server - just for test purposes. Try connecting to a website now, something you haven't visited before so it won't be cached, try www.iol.ie

Another option would be to set IE up to go through an anon proxy server on the net - again for test purposes only.

http://www.publicproxyservers.com/page1.html

This has me stumped! But we'll keep trying.

Quote:

---

This has me stumped! But we'll keep trying.

---

THANKYOU! :)

OMG! I actually opened a webpage with IE after using a public Proxy Server namely 165.228.131.10:3128 - It took at least 4 minutes for the page to appear which was www.ebroadcast.com.au .

Note:I have also fiddled with the TCP/IP Settings on the adapter to include the DNS Suffix and also the WINS Server address which again, is exchange. I dont think this has assisted in anything.

I have also started a new line of investigation. Instead of internet connectivity I am now looking at extremely slow internet on terminal services. Maybe that would be the next step?

[edit]That doesnt explain why some pages load with nothing, add www.hotmail.com to that list. [/edit]

CTO

Well that can be quiet common for public proxies to take that long.

I think it is a problem with your DNS Server?

Also, my next option would be to install ethereal and see what packets are going out from your Terminal Services Server - I've seen before where an awful lot of traffic from malfunctioning apps can cause this.

Another thing to consider and I should have said earlier is a faulty network card - can you replace - even as a test?

I Have also created a new account so it was a fresh profile with no cached pages etc but still same problems. So not a profile or caching issue.

I wont list sites that are working or not working because that wont help. It seems to be ....... random/sparodic on which pages load and which dont. For exmaple, the microsoft.com page usually appears to be loading and never does, but just recently it loaded and displayed nothing like the google page.

Anyway, will soldier on.

Quote:

---

(1)Well that can be quiet common for public proxies to take that long.

(2)I think it is a problem with your DNS Server?

(3)Also, my next option would be to install ethereal and see what packets are going out from your Terminal Services Server - I've seen before where an awful lot of traffic from malfunctioning apps can cause this.

(4)Another thing to consider and I should have said earlier is a faulty network card - can you replace - even as a test?

---

1) I thought that might be the case
2) How can it be? It is using the same DNS Server as the rest of the network.
3) Great Idea!!!
4) Truely possible, but connection to the terminal server via RDP and using the applications installed (usualy at least 5 users) would imply the NIC is running smoothly.

Will it help to post the ethereal captures? Anyone who can understand and identify a problem?

[edit]I am getting huge amounts of Errors - Bad Checksum. This is when i am attempting to browse and AFAI can tell it seems that the packets are coming back corrupt or the whatever is doing the checksum is not right. And from what i can see this IS my problem right here..... the bad checksums[/edit]

Troubleshooting DNS issues is one of those things I just hate doing.

Now before I give advice, typically its good practice NOT to access the internet from a server. I know a lot of companies restrict this as to keep the risk of malware and virus to a minimum on servers. /Disclaimer

Have you tried a new network card? Have you tried IPCONFIG /flushdns

Have you tried entering a manual entry for another name server other than your Exchange box?

You know this sounds familar...

I had a problem with a site and web pages loading...some not

This was happening on all workstations...after working with the ISP we lowered our MTU setting on the router and all was well.

so...I did a search MTU Terminal Server

and found lots of stuff

http://www.google.com/search?q=MTU+t...e=utf8&oe=utf8

May wanna look at it and see if any relates to your situation...

Ms has some stuff too....

http://support.microsoft.com/search/...query=MTU&adv=

Hope this helps

MLF

Yeah post the ethereal outputs - one complete and the other filtered with only the bad checksums.

I think replacing the NIC nightn't be a bad idea - for test purposes.

Also, it's not harm adding a DNS Server for test purposes either.

Thanks MLF :) Will sus it out.

Quote:

---

(1)Now before I give advice, typically its good practice NOT to access the internet from a server. I know a lot of companies restrict this as to keep the risk of malware and virus to a minimum on servers. /Disclaimer

(2)Have you tried a new network card? Have you tried IPCONFIG /flushdns

(3)Have you tried entering a manual entry for another name server other than your Exchange box?

---

1)My aim is not to give internet access to users from the terminal server. It is simply to access the FTP website and upload files from the application that is installed on the terminal server. I can access the FTP site and download files but they will not upload.

2) Have not swapped the NIC yet, and yes DNS has been flushed.

3) Yes, i have used various other DNS servers, ones i know to work and use often. This does not help. Please note that all hostnames resolve completely so i dont think it is DNS related.

This Bad Checksum thing could explain alot and my first instinct as to why it is happening is a faulty NIC.... im sure others would agree. Anyways, i will post the ethereal logs tomorrow as its 1AM now and my bed beckons.

Thanks guys!!!


CTO

http://groups.google.com/groups?q=MT...=1&sa=N&tab=wg

Somemore reading ...same search in google groups

MLF

Whats the best way to post the ethereal logs? Plain text or text file attachment? It just seems exuberant.

Hi, pls.. solved a problem one at a time first check check your router configuration static or dynamic if its can connected to internet the terminal server is different story


here is a simple diagram

provider-router -------- your router/firewall---------hubs------> terminal, web-server and others



all this things could do via port forwarding

i hope this will help u

We've been over the basics pvclink, thanks anyways.

And CTO - post in an attachment if you can.

ok i follow the thread so his problem is the terminal server browser may i know if your terminal server is working properly or maybe your internet browser had proxy configuration again check if correct if you had a firewall maybe the problem is there, one more thing if you can ping your gateway which is your router IP there is no other reason why you could not browse to internet other than virus

yes sort off

internet-----(202.61.x.x)firewall/router(exchange,192.168.0.2)----(192.168.0.3)Terminal Server

THE PROBLEM HAS BEEN SOLVED!!!!!!!!!!

I went back out onsite to test an alternate NIC, 2nd Onboard NIC is disabled and not needed. Copy over IP Configuration and connect - exact same issue.

Sticking with my gut feeling and still focusing on the NICs i went into the adapter properties and checked the advanced tab and i found a couple of interesting values.

NIC (x2) - INTEL(R) Pro 1000 EB Network Connection with I/O Acceleration. Under the advanced tab i found these;

Quote:

---

Offload Recieve IP Checksum
Offload Recieve TCP Checksum
Offload Transmit IP Checksum
Offload Transmit TCP Checksum
Offload TCP Segmentation

---

Each of these has a value of either ON|OFF and each was set to ON. I switched all of these options to OFF and hey presto. Web browsing clockwork and lights all started happening :p . Works with and without a public proxy server and uses the original configuration as wanted. Also, once these options were off the ethereal does not display any errors at all.

I have replicated this so it is definitely the problem. I will still post the ethereal logs shortly in both before and after.

Thanks for all your help with this guys, could not have done it without you :)


CTO (Chillaxed)

Hey gang,

Ethereal logs attached in a zip file. 2x files one is with options ON and the other with options OFF. File name says it all. Extention is .txt but you know what you need to do to read it.

Anyway i would be interested for someone to elaborate on what actually is happening if anyone will look at it and can see the forest through the trees, as it were.

Again, thanks for all your help with this guys! Look forward to seeing you around the forums.


CTO

No problem CTO - I will download the log files and look through them when things aren't so hectic here.

Glad could help.

Quote:

---

Anyway i would be interested for someone to elaborate on what actually is happening if anyone will look at it and can see the forest through the trees, as it were.

---

Well, I was waiting for someone else's interpretation of those dumps, but since some time has past and no replies .... I am going to go way out there and give my gut impression.

From the dumps it appears you ran Ethereal on the Terminal Server.

As I see it, it is going to be hard to diagnose the exact cause because of where the packets were captured from. My guess is a packet capture off a span port on a switch would have been a little more useful.

The checksum errors were merely a normal consequence of running Ethereal on the same machine with Offload Checksum enabled on the NIC. Ethereal is capturing the packets before the NIC establishes the checksum. This appears to be a known issue. ( Until now we did not know you were using a gigabyte NIC. )

So I am not sure that turning the checksum offloading had anything to do with the fix.

I think your main problem was what was eluded to earlier by morganlefay , namely MTU, et al, which is affected by your changing the setting for Offload TCP Segmentation to off.

My guess is the problem may have been incompatibility between the way the Terminal Server NIC handles TCP Segmentation and the way your switch ( apparently a Netgear ) and/or the Exchange Server NIC does.

I could be way off, I am no expert on this stuff.

Any any other ideas?

Quote:

---

The checksum errors were merely a normal consequence of running Ethereal on the same machine with Offload Checksum enabled on the NIC. Ethereal is capturing the packets before the NIC establishes the checksum.

---

That makes sense.

Quote:

---

I think your main problem was what was eluded to earlier by morganlefay , namely MTU, et al, which is affected by your changing the setting for Offload TCP Segmentation to off.

---

Ok.... so lets run with this. Firstly, there is no denying that the aforementioned NIC values were the cause of the problem. So, why is the NIC causing such an issue, and if indeed it is an MTU Setting, at what point is the problem occuring (where along the traffic route) and how can i modify the MTU settings.

It seems anyone guess at this stage, however i am happy to replicate problems and do some more diagnostics to figure it out - otherwise the old saying if it aint broke dont fix it comes to mind :p

CTO

Links to look at....

http://support.microsoft.com/search/...query=MTU&adv=

This may be it

http://support.microsoft.com/kb/898060/en-us

Quote:

---

Network load balancing, dynamic routing, or both are used. In this scenario, there are several possible routes to a destination that has MTUs that differ from the MTU of the sending subnet and that differ from each other. Therefore, changing the route of IP packets over time can produce several MTU updates for the destination address.

---

Quote:

---

WORKAROUND
To work around this problem, set the default MTU size to the largest size that the routers can process. The actual MTU value that is required to work around this problem depends on the network configuration. However, an MTU value of 576 should help reduce the effect of the problem because routers on the Internet should be able to handle such packets without fragmentation. You must restart the computer for this registry change to take effect. For more information about how to change the MTU registry settings, click the following article numbers to view the articles in the Microsoft Knowledge Base:
120642 (http://support.microsoft.com/kb/120642/) TCP/IP and NBT configuration parameters for Windows 2000 or Windows NT
314053 (http://support.microsoft.com/kb/314053/) TCP/IP and NBT configuration parameters for Windows XP
Important Depending on the network configuration and typical networking applications used, setting a low default MTU value can cause the network performance to decrease.

---

Use ping to determine the correct MTU

http://help.expedient.net/broadband/mtu_ping_test.shtml

HTH

MLF

This sh*t is way over me.

Quote:

---

however i am happy to replicate problems and do some more diagnostics to figure it out -

---

The only thing I can think of ( other then contacting the vendors ) is setting up four simultaneous packet captures, one on each server machine, one on each side of the switch. Then compare for discrepancies.
A Lot of trouble for something that is now working!

Just a couple of links I came across that may or may not help:

Check System Requirements for Intel® I/O Acceleration Technology (Intel® I/OAT)
Jumbo Frame Clean Networking Gear


also, if this actually applies ( from download html files, self-extracting, User Guide for Intel® Network Adapters )

Quote:

---

All equipment on the network must also support the larger frame size. When setting up Jumbo Frames on other network devices, be aware that different network devices calculate Jumbo Frame size differently. Some devices include the header information in the frame size while others do not. Intel adapters do not include header information in the frame size. When configuring Jumbo Frames on a switch, set the frame size four bytes higher for CRC, plus four bytes if you are using VLANs or QoS packet tagging.

---