Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Not applicable

Windows DNS server behind Fortigate

Hi guys, If someone can point me to the right direction, that would be really appreciated. What I am trying to achieve here is getting my Windows DNS server that is sitting behind Fortigate to perform name resolution for my website. Registered Website name: For this example I am using - mywebsite.com This is from Godaddy. My ISP has given me only 1 Public IP which I use as a VIP for load balancing webservers. i.e. 202.XX.XX.XX > Round robins either 192.168.1.44 or 192.168.1.45 At the moment, At GoDaddy, I have added an A record @ 202.XX.XX.XX (my Public VIP) so all the http requests come to my webservers and people can reach my website. However, I do not want to rely on Godaddy' s DNS and would like my own DNS server. For this I went to Godaddy' s panel and added my DNS server' s name under NS records. i.e. RESOLVE1.mywebsite.com However, this is not working. When I check this via dnsstuff.com, it reports the following: ns33.domaincontrol.com [216.69.185.17] 203.XX.XX.XX 30ms resolve1.mywebsite.com [0.0.0.0] Timeout If I refresh the page, it shows - ns33.domaincontrol.com [216.69.185.17] 203.XX.XX.XX 30ms resolve1.mywebsite.com [192.168.1.52] Timeout Here are my DNS and webserver settings: DNS Server IP config settings: IP 192.168.1.52 Mask 255.255.255.0 Gateway 192.168.1.1 (Fortigate) DNS 192.168.1.52 Fully qualified name: RESOLVE1.mywebsite.com WEB Server 1 IP config settings: IP 192.168.1.44 Mask 255.255.255.0 Gateway 192.168.1.1 (Fortigate) DNS 192.168.1.52 Fully qualified name: WEBSERVER1.mywebsite.com WEB Server 2 IP config settings: IP 192.168.1.45 Mask 255.255.255.0 Gateway 192.168.1.1 (Fortigate) DNS 192.168.1.52 Fully qualified name: WEBSERVER2.mywebsite.com Can some one please advise: Do I have to set up Port Forwarding on Fortigate? Do I have to configure any policy on Fortigate? Regards,
17 REPLIES 17
Not applicable

@ 202.XX.XX.XX (my Public VIP) not 203.x.x.x...
Sorry about the typo. The correct VIP is 203.XX.XX.XX I have attached the conf firewall vip show
Not applicable

(vip) # show config firewall vip edit " MYSQL" set comment " VIP for MYSQL" set type server-load-balance set extip 192.168.1.103 set extintf " internal" set server-type tcp set monitor " Health" set extport 3306 config realservers edit 1 set ip 192.168.1.102 set port 3306 next edit 2 set ip 192.168.1.101 set port 3306 next end next edit " VIP" set type server-load-balance set extip 203.XX.XX.XX set extintf " port4" set server-type http set monitor " HealthHTTP" set ldb-method round-robin set persistence http-cookie set extport 80 config realservers edit 1 set ip 192.168.1.45 set max-connections 40000 set port 80 next edit 2 set ip 192.168.1.46 set port 80 next end next edit " 192.168.1.50" set type server-load-balance set extip 192.168.1.50 set extintf " internal" set server-type ip next edit " DNS_VIP" set extip 203.XX.XX.XX set extintf " port4" set portforward enable set mappedip 192.168.1.52 set extport 53 set mappedport 53 next edit " DNS_VIP_UDP" set extip 203.XX.XX.XX set extintf " port4" set portforward enable set mappedip 192.168.1.52 set protocol udp set extport 53 set mappedport 53 next end
Not applicable

(policy) # show config firewall policy edit 1 set srcintf " any" set dstintf " port4" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " HTTP" " HTTPS" " DNS" set logtraffic enable set nat enable next edit 2 set srcintf " internal" set dstintf " any" set srcaddr " all" set dstaddr " MYSQL" set action accept set schedule " always" set service " MYSQL" set logtraffic enable next edit 11 set srcintf " port4" set dstintf " internal" set srcaddr " all" set dstaddr " DNS_VIP" set action accept set schedule " always" set service " DNS" next edit 14 set srcintf " port4" set dstintf " internal" set srcaddr " all" set dstaddr " DNS_VIP_UDP" set action accept set schedule " always" set service " DNS" next edit 3 set srcintf " port4" set dstintf " internal" set srcaddr " all" set dstaddr " VIP" set action accept set schedule " always" set service " HTTP" next end
Not applicable

Some additional information: When I ping resolve1.mywebsite.com from my workstation it returns: C:\Users\admin>ping resolve1.mywebsite.com Pinging resolve1.mywebsite.com [192.168.1.52] with 32 bytes of data: Reply from 192.168.1.52: bytes=32 time=1ms TTL=128 Reply from 192.168.1.52: bytes=32 time<1ms TTL=128 Reply from 192.168.1.52: bytes=32 time<1ms TTL=128 Reply from 192.168.1.52: bytes=32 time=2ms TTL=128 Regards,
ede_pfau
SuperUser
SuperUser

holy smokes...get your documentation CONSISTENT! this is tiresome so your web servers really are .45 and .46? good. policies and VIPs look OK. Some more hints where to debug: - make sure your DNS answers requests from all source addresses - how do you test your DNS? try nslookup, ENTER ' server 203.xx.xx.xx' web1 ... quit this uses DNS only (udp/53). - you use interface ' any' a lot. Try to avoid this if ever possible. Specify the interface you really mean to get a grip on your security. (though I don' t think this interferes with your DNS problem here.) So there are 2 possible reasons for not getting DNS replies: - your DNS server never sees the request - it does but you never see your server' s reply Of course you have the right default route set up on your DNS. Please check again. If all fails you' ll have to sniff the traffic to get answers.
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
rwpatterson
Valued Contributor III

Here' s my question: Is the Windows server allowed to respond to external (non LAN) DNS queries?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Not applicable

Hi all, Thanks to all. This issue has been resolved. I really wish there was a resolved button somewhere so people would take a note of this resolved post and this post would help someone in my situation. Special thanks to ede_pfau. I owe you a beer mate. Regards, Inder Lamba
ede_pfau
SuperUser
SuperUser

Never mind. It' s really the community here, we' re all working together as a team. I really think the Forums are special in a way. Professional, polite and personally at times. I' d be glad to have a beer or two with you if you send me a flight ticket. Or, if you just contribute with your experience and help others out in the future. I' m sure we won' t run out of questions anytime soon...
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors