Hi all, question. How would you do the following? When the edge client is connected, I’d like to forward dns requests to another server (ie internal domain controller). This would allow clients to do active directory stuff like joining domains etc just by having the ziti client connected. I was …

thank you @gooseleggs !, I had found an article similar on netfoundry. It seems to resolve with the SRV records, but things like gpupdate don’t work yet…will do some wiresharking

@cjpit , welcome to OpenZiti! And thanks for the assist @gooseleggs . Make sure you get an updated Wireshark. A while back (6mo ish I think) they updated it to work with WinTUN adapaters - you’ll need that to see any packets. If we can help, let us know.

Well, I’m not sure what I’ve done now but keep getting refused for the dns requests… It did work for a little bit, then I went to cleaning up some of my policies, and alas I can’t get it to work. this is the wireshark output 1 0.000000 100.64.0.1 100.64.0.2 DNS 76 Standard query 0xc413 SRV _ldap.…

Hi @cjpit - Did you add the DNS sever IP in the ER that is the terminator for the AD? Since you are familiar with cloudziti ( NetFoundry), refer the steps here - https://support.netfoundry.io/hc/en-us/articles/9850601290381-Join-Active-Directory-Domain-Controller-from-windows-machine-running-WDE I…

Thank you @surennaidu , yeah I had seen those articles, I think however I’m running into a bug or something weird on the windows tunneller client. Even if i have my edge router offline, it does the same thing on the client. For example, with the *.XXX.local, basically any dns request will always r…

Hi @cjpit - “-” is allowed but “_” is not allowed in DNS names. Were you able to get your windows machine join the AD? The use of underscores in hostnames violates RFC 1123’s valid defined characters for a domain name.

here is a bit of debug info from the client when using the _underscore it doesn’t find the matching domain [2022-11-29T06:47:39.343Z] DEBUG tunnel-sdk:tunnel_udp.c:252 recv_udp() intercepted address[udp:100.64.0.2:53] client[udp:100.64.0.1:51931] service[ziti:dns-resolver] [2022-11-29T06:47:39.34…

@surennaidu that’s strange then and why it’s not working, how can it resolve the AD domain servers then? The first step of joining a domain, the client goes looking for _ldap._tcp.dc._msdcs.XXX.local -Type SRV to find who the domain controllers are. It actually throws that error in the windows pop…

Ok @cjpit - I see in your service config that you have allowed port 53. Is that the only port you have listed? Can you add the other ports listed in Conneting Remote Endpoints with a On-Prem AD - #8 by emoscardini or the range 1-65535 for testing?

Desktop edge windows client and dns

gooseleggs November 28, 2022, 11:10am 3

Actually - this is what I was actually wanting to point to: Conneting Remote Endpoints with a On-Prem AD - #6 by emoscardini

Topic		Replies	Views
Hosting AD-related services via ziti-edge-tunnel on any domain-joined Windows host (DC or member server) breaks Cloud Kerberos Trust ticket issuance for Entra ID–joined dial clients; same configuration on an Edge Router works Ziti Overlay	4	70	June 9, 2026
Issue with DNS Interception — Traffic Not Routing Through AD DNS Support	44	570	November 17, 2025
DNS issue with Tunnelers on Debian and Windows	21	521	September 12, 2023
Ziti Desktop Edge Windows, tunneling not working Tunneler Apps	16	321	October 21, 2022
Launched openziti network using docker compose, but client not able to fetch simple blue service Building/Development	40	1814	May 27, 2022

Desktop edge windows client and dns

Related topics