Hi all, question. How would you do the following? When the edge client is connected, I’d like to forward dns requests to another server (ie internal domain controller). This would allow clients to do active directory stuff like joining domains etc just by having the ziti client connected. I was …

Hi @cjpit - Did you add the DNS sever IP in the ER that is the terminator for the AD? Since you are familiar with cloudziti ( NetFoundry), refer the steps here - https://support.netfoundry.io/hc/en-us/articles/9850601290381-Join-Active-Directory-Domain-Controller-from-windows-machine-running-WDE I…

Thank you @surennaidu , yeah I had seen those articles, I think however I’m running into a bug or something weird on the windows tunneller client. Even if i have my edge router offline, it does the same thing on the client. For example, with the *.XXX.local, basically any dns request will always r…

Hi @cjpit - “-” is allowed but “_” is not allowed in DNS names. Were you able to get your windows machine join the AD? The use of underscores in hostnames violates RFC 1123’s valid defined characters for a domain name.

here is a bit of debug info from the client when using the _underscore it doesn’t find the matching domain [2022-11-29T06:47:39.343Z] DEBUG tunnel-sdk:tunnel_udp.c:252 recv_udp() intercepted address[udp:100.64.0.2:53] client[udp:100.64.0.1:51931] service[ziti:dns-resolver] [2022-11-29T06:47:39.34…

@surennaidu that’s strange then and why it’s not working, how can it resolve the AD domain servers then? The first step of joining a domain, the client goes looking for _ldap._tcp.dc._msdcs.XXX.local -Type SRV to find who the domain controllers are. It actually throws that error in the windows pop…

@surennaidu Yeah I’ve tried that and have re-enabled with full open ports. Here is the log for the Resolve-DnsName _ldap._tcp.dc._msdcs.XXX.local [2022-11-29T07:30:51.106Z] DEBUG tunnel-sdk:tunnel_udp.c:252 recv_udp() intercepted address[udp:100.64.0.2:53] client[udp:100.64.0.1:49222] service[z…

@cjpit - And you confirm that You have added the route to the DNS server in the private ziti router that is connected to the DNS server? This is step 7 described in the article - Add DNS server IP in Customer Hosted ER and You are able to resolve the DNS from the private router? [image] c…

Hi @cjpit Just reviewing this thread. Figured I’d show you what it looks like for a successful SRV lookup from the logs: [2022-11-29T09:20:35.835Z] INFO tunnel-cbs:ziti_dns.c:641 proxy_domain_req() writing proxy resolve [{ "status":0, "id":2075, "recursive":0, "question":[{ "name":"_ldap…

@emoscardini ah great, at least that makes sense as to what is happening with the logging. I have other services working fine through that tunnel, http and rdp on other XXX.local addresses. I wondered if they may have taken precendence in it, so I set up just a single identity with that one servic…

Desktop edge windows client and dns

surennaidu November 29, 2022, 7:32am 12

Ok @cjpit - I see in your service config that you have allowed port 53. Is that the only port you have listed? Can you add the other ports listed in Conneting Remote Endpoints with a On-Prem AD - #8 by emoscardini or the range 1-65535 for testing?

Topic		Replies	Views
Hosting AD-related services via ziti-edge-tunnel on any domain-joined Windows host (DC or member server) breaks Cloud Kerberos Trust ticket issuance for Entra ID–joined dial clients; same configuration on an Edge Router works Ziti Overlay	4	68	June 9, 2026
Issue with DNS Interception — Traffic Not Routing Through AD DNS Support	44	568	November 17, 2025
DNS issue with Tunnelers on Debian and Windows	21	519	September 12, 2023
Ziti Desktop Edge Windows, tunneling not working Tunneler Apps	16	316	October 21, 2022
Launched openziti network using docker compose, but client not able to fetch simple blue service Building/Development	40	1809	May 27, 2022

Desktop edge windows client and dns

Related topics