I’m trying to get Exchange 2010 working behind the RouterBoard. Exchange is not able to send mails: the queue stays full; with the messages that the DNS look up failed.
Strange, that it’s true not for all the messages: some of them getting sent, some of them stay in the queue.
I see this behavior only if I set the RouterBoard as a main gateway. If I replace it with another router (LANCOM, different models), then Exchange works without any problems. The problem is the configuration of the RouterBoard.
My config follows. I would appreciate any help.
/ip address
add address=192.168.10.254/24 interface=ether2
add address=[public static IP]/30 interface=ether1
/ip dns
set allow-remote-requests=yes servers=[DNS server 1 provided by ISP],[DNS server 2 provided by ISP]
/ip firewall filter
add chain=input protocol=icmp
add chain=input connection-state=established
add chain=input connection-state=related
add action=drop chain=input in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment="Outgoing traffic" out-interface=ether1
add action=dst-nat chain=dstnat comment="Incoming SMTP" dst-address=[public static IP] dst-port=25 protocol=tcp to-addresses=192.168.10.6 to-ports=25
add action=masquerade chain=srcnat comment="Incoming SMTP from the local network" dst-address=192.168.10.6 dst-port=25 out-interface=ether2 protocol=tcp src-address=192.168.10.0/24
add action=dst-nat chain=dstnat comment="Incoming ActiveSync" dst-address=[public static IP] dst-port=443 protocol=tcp to-addresses=192.168.10.1 to-ports=443
add action=masquerade chain=srcnat comment="Incoming ActiveSync from the local network" dst-address=192.168.10.1 dst-port=443 out-interface=ether2 protocol=tcp src-address=192.168.10.0/24
add action=dst-nat chain=dstnat comment="Incoming HTTP" dst-address=[public static IP] dst-port=80 protocol=tcp to-addresses=192.168.10.2 to-ports=80
add action=masquerade chain=srcnat comment="Incoming HTTP from the local network" dst-address=192.168.10.2 dst-port=80 out-interface=ether2 protocol=tcp src-address=192.168.10.0/24
add action=dst-nat chain=dstnat comment="Incoming PPTP" dst-address=[public static IP] dst-port=1723 protocol=tcp to-addresses=192.168.10.1 to-ports=1723
add action=masquerade chain=srcnat comment="Incoming PPTP from the local network" dst-address=192.168.10.1 dst-port=1723 out-interface=ether2 protocol=tcp src-address=192.168.10.0/24
/ip route
add distance=1 gateway=[Provided by ISP]
/ip service
set telnet disabled=yes port=1023
set ftp disabled=yes port=1021
set www disabled=yes port=1080
set ssh disabled=yes port=1022
set winbox address=192.168.10.0/24
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=ar
/system ntp client
set enabled=yes mode=unicast primary-ntp=[Some public NTP Server] secondary-ntp=[Some public NTP Server]
I think your src-NAT rules may be causing trouble. I think you only need one srcnat that match the out-interface and have the action of masquerade. Try disablein all others.
Id recommend pinpoint zones on your dns for exchange resources combined with removing your nat hairpin config on the routerboard.
The source of the current issue would be (as mentioned before) your masquerade rules. This is assuming your dns is 100% configured correctly, this assumes the lancoms didnt have different configurations
You should check to see what DNS your server is using, I am assuming that it is forwarding the DNS to the routerboard. Make sure that the max size of the UDP reply on the routerboard is large enough, I use 4096.
You could try setting the DNS forwarders to your ISP DNS. Also you can try googles public DNS which is 8.8.8.8
On the Exchange server? It were not a perfect setup. The Exchange server is also the AD and DNS server and has in it’s settings itself as a DNS server - it’s the correct setup for the Active Directory. The RouterBoard is entered as a gateway for the AD-domain.
Still: another router being set up instead of RouterBoard does it’s job.
how is your DNS setup on the dns/exchange server? if it was ‘correct’ then there should be no reliance upon your router for DNS. do not use the router and set your dns forwarders with the IP’s your ISP has provided you and that will be all.
I repeat myself: every router by LANCOM - I tried three of them - having the configuration which is similar to the one I posted in the first posting - forward DNS queries without any workarounds. I would like the RouterBoard to forward DNS queries, too.
Properly configuring your DNS forwarders in the windows server is not a workaround, it is proper configuration. Your windows server should either be doing full lookups or it should be forwarding to servers that are doing full lookups. Otherwise I would not be surprised to have issues from time to time.
As far as testing the DNS Caching features of your routerboard you can use nslookup (on windows) or host (on mac or linux) to do manual queries… you should be able to query your routerboard as well as google’s 8.8.8.8 and get the same results.
thank you for teaching me, how to check DNS lookups
I wouldn’t have written here, if I didn’t do it already.
But the problem still exists. With the RB450G or RB951G-2HnD. And it doesn’t exist with any router from Lancom…
If your server is doing full lookups and it is able to answer DNS then your router isn’t causing any problems for it… so something is wrong on your server because the router would not be selectively bothering your DNS. It would either allow DNS through it or it wouldn’t assuming that you were not limiting its connectivity some how like connection limiting which would be an intentional config.
However if your DNS is relying on the DNS of the router then the router would defiantly stand a chance of causing problems.
I have administrated a lot of DNS servers over the years and I always setup client machines for DNS forwarding and have never regretted it. I also always configure the servers that I run at an ISP level for Full lookups. I only use BIND on linux for DNS at the ISP level. The last Windows DNS server that I ran that served DNS to clients was back around 2000 when I worked for a dialup ISP that used Windows NT4 for DNS and RADIUS. Migrating off that mess was a nightmare that I’ll never forgit and hope to never relive. I am sure windows is better today for services like DNS but the big difference remains that with a service like BIND I can read and understand absolutely every line of the config in a linear manner, I don’t have to hunt and peck through many screens and find odd registry eateries etc to know exactly how my services are configured.
Sorry for the rant… scary memories of trying to tame nebulous beasts again.
I recommend that you use DNS forwarding however it will work fine doing full lookups. Clear your cache and then view your cache to ensure that it is populating properly.
Active Directory needs an authorized DNS server in it’s hierarchy. And in a [Windows touched] SMB company it’s the normal way if you have only one-two servers running AD, Exchange, DHCP, DNS, file, print… On the other hand, since NT4 there is a huge progress in the networking services bundled with Windows servers. Nowadays, you can really work with it.
Maybe you can. I’ve not tried 2012 but it seems as of 2008 that the trajectory is to hide things even more. The disease that infected the control panel in windows 7 has seemingly spread to IIS and other MMC controlled tools in Server 08. Why the advanced site identification button has moved to a bindings link in a right panel I don’t know… but I do know that it consumed a half hour of my life trying to figure out the new interface and the whole time I was wishing I could just go to /etc/apache/sites-enabled/ and edit a config file that handled the entire site setup in 5 or ten lines of clean simple options.
routeros dns server does not only reply mx records when asked for this type. it also puts all other types like a or ns in the response. exchange server gets confused with this. there is a setting in the outgoing tranport to use external dns server. this will solve the problem but dont ask me why.
Can you show an example of this? I am seeing that the MX record report from my MikroTik is exactly the same as Google’s public DNS
Here is a query for type mx against my home RouterOS RB2011:
Joshaven-Potters-iMac:~ joshaven$ host -tmx mikrotik.com 10.70.99.1
Using domain server:
Name: 10.70.99.1
Address: 10.70.99.1#53
Aliases:
mikrotik.com mail is handled by 10 mailgw.mikrotik.com.
mikrotik.com mail is handled by 50 mailgw2.mt.lv.
Here is the same query type mx against Google’s public DNS:
Joshaven-Potters-iMac:~ joshaven$ host -tmx mikrotik.com 8.8.8.8
Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases:
mikrotik.com mail is handled by 10 mailgw.mikrotik.com.
mikrotik.com mail is handled by 50 mailgw2.mt.lv.
