problems configuring NAT (70-642 prep)

[stefu]

hi there,

 

i'm struggling with the MS 70-642 "configuring network infrastructure" book. right now i'm in chapter 7 "connecting to networks" and i want to configure a NAT server and client. somehow i can't manage to get the nat client to connect to the internet.

i followed the instructions in the book, my configuration looks like this:

 

2 virtual machines in virtualbox, each running windows server 2008 r2

 

server 1:

- installed the ad ds, dhcp, dns and network policy and access services roles

- assigned 2 netword adapters for the machine. one that uses NAT (resp. my host computer's configuration = internet access. my host resides in a domain environment) and one internal adapter.

- configured routing and remote access according to the instructions in the book

(server manager --> (...) --> routing and remote access --> ipv4 --> NAT --> address assignment --> automatically assign ip addresses by using the dhcp allocator --> entered 192.168.0.1 and 255.255.255.0)

 

i left out the configuration of wpa-eap authentication for a wireless access point which i had to do in the previous chapter because i don't have the hardware needed for this. nevertheless i believe this can be done without configuring wireless networking because the virtual network adapters simulate a cable connection.

 

the first network interface, as said, is dhcp-configured and connects to the host- / domain network

second interface:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Intel® PRO/1000 MT Network Connection #2

Physical Address. . . . . . . . . : 08-00-27-80-94-BD

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

IPv4 Address. . . . . . . . . . . : 192.168.0.1(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 0.0.0.0

DNS Servers . . . . . . . . . . . : 192.168.0.1

NetBIOS over Tcpip. . . . . . . . : Enabled

 

in network and sharing center i see the domain network i set up in previous chapters of this book (nwtraders.msft), the two network adapters are available on the right. on server 1 i have internet access.

 

i also got several errors from the roles on server 1. i restarted the dhcp and dns role services and no new error messages appeared since then.

 

server 2:

- installed file services and dns server roles (dns role is stopped)

- assigned one virtual network adapter for the machine which is internal.

- IP configuration is set to automatic because it should get the configuration from the other server.

 

after i ran ipconfig /release and ipconfig /renew the IP configuration on server 2 looks like this:

 

Connection-specific DNS Suffix . : nwtraders.msft

Description . . . . . . . . . . . : Intel® PRO/1000 MT Desktop Adapter

Physical Address. . . . . . . . . : 08-00-27-1B-8E-0A

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IPv4 Address. . . . . . . . . . . : 192.168.0.21(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Lease Obtained. . . . . . . . . . : Dienstag, 17. April 2012 12:33:36

Lease Expires . . . . . . . . . . : Mittwoch, 25. April 2012 12:33:36

Default Gateway . . . . . . . . . : 192.168.0.1

DHCP Server . . . . . . . . . . . : 192.168.0.1

DNS Servers . . . . . . . . . . . : 192.168.0.1

NetBIOS over Tcpip. . . . . . . . : Enabled

 

well, i CAN ping server 1 from server 2 (name, fqdn and IP) and vice versa. but i can't access the internet from server 2.

 

i'm not sure if my problem results from the fact that both servers communicate on the nwtraders-msft domain level ?

 

i'm really stuck here, i know this is a huge topic (with a lot to read :/) and there could be a lot of points of failure but i hope that someone could give me some answers on this.

 

thanks in advance,

stefu

[ICTCity]

I have to think about this problem, but can you please run a tracert to internet? From server 2. Then, can you ping your router from server 2?

 

Let me know

 

Viel Glck ;)

[stefu]

alright, i'll look at this tomorrow, although i'm pretty sure that a tracert would run into nothing. as for the router, phew first i gotta find my way through our corporate domain ;)

 

danke frs erste!

[ICTCity]

I think the problem is with your router, if it nats too the you can have problems.

 

woher kommst du?

[stefu]

a tracert on the router does not work because we're behind a TMG and stuff. a tracert to the internet does not work either (both on server 2), so we're still stuck where we were yesterday.

i'm also trying to get rid of the 0.0.0.0 default gateway on the second interface of server 1, but nothing seems to work (route delete 0.0.0.0, netsh, ...)

i now checked some services and started some here and there which i think could have something to do with this, but i'm really not sure.

 

ich komm aus deutschland, bayern, oberpfalz, regensburg. ;)

[stefu]

i mean pinging the router. neither does work. i've managed to ping the interface on server 1 that is connected to the internet but i don't get past that.

[stefu]

gnah. i gave up and killed the config by switching back to a much earlier snapshot of the machines and now try to work my way back to this. i'm gonna let you know when i'm there. *'%*&$/%/ !

[ICTCity]

so it looks like 2 Nat can't work together. Anyway it's strange that you don't have the gateway address but it could be right because you are natting from Nic 1 to 2.

if you disable Nat, the second server can surfs?

 

ich war fr ein Monat in Mnchen gewesen.

[stefu]

if i disabled NAT on server 1 (which is the setting i had before) i wouldn't have been able to access the internet from server 2 either. but this is just fine since i only ever had an internal connection between server 1 and server 2 where server 1 had no interface configured to get outside that internal network.

but yes, it seems like server 2 could not connect via NAT through server 1's internet-connected interface because this interface again is provided by another NAT. and then there's the TMG in the way and i dunno what else. so i'm still working my way back and let's see, maybe i broke something in first place which i can now get to work right (whether on purpose or by accident) which lets me accomplish this tricky little thingy.

 

ah mnchen, okay. warst du jobmig unterwegs?

[ICTCity]

I'm pretty sure you can't do Nat behind another Nat...

 

ja aber es war mehr Ferien als Arbeit :) jetz ich sollte fr eine Firma in Zrich arbeiten