Wireless router on DMZ

[hamza786]

Wireless router on DMZ not able to resolve DNS. Connected to the router locally I can ping public IP addresses but can not browse using the browser. Please advise!

C:\>nslookup 10.200.215.254
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  10.200.215.254

DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out
--------------------------------------------------------
C:\>nslookup 75.75.75.75
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  10.200.215.254
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out
-----------------------------------------------------------------
C:\>ping 75.75.75.75

Pinging 75.75.75.75 with 32 bytes of data:
Reply from 75.75.75.75: bytes=32 time=22ms TTL=54
Reply from 75.75.75.75: bytes=32 time=21ms TTL=54
Reply from 75.75.75.75: bytes=32 time=21ms TTL=54
Reply from 75.75.75.75: bytes=32 time=20ms TTL=54

Ping statistics for 75.75.75.75:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 20ms, Maximum = 22ms, Average = 21ms

C:\>tracert 75.75.75.75

Tracing route to 75.75.75.75 over a maximum of 30 hops

  1     1 ms     1 ms     1 ms  10.200.215.1
  2     1 ms     1 ms     1 ms  10.200.215.254
  3     9 ms    10 ms     9 ms  10.200.40.1
  4     8 ms     8 ms     9 ms  192.168.7.53
  .
.

  9    23 ms    22 ms    22 ms  68.86.90.214
 10    23 ms    23 ms    21 ms  96.108.37.118
 11    22 ms    21 ms    21 ms  68.87.225.66
 12    20 ms    21 ms    21 ms  75.75.75.75

Trace complete.
------------------------------------------------------------
C:\>tracert www.yahoo.com
Unable to resolve target system name www.yahoo.com.
---------------------------------------------------------
C:\>ipconfig /all
Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : R
   Physical Address. . . . . . . . . : 
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.6.22(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Friday, November 17, 2017 9:50:42 AM
   Lease Expires . . . . . . . . . . : Saturday, November 18, 2017 9:50:42 AM
   Default Gateway . . . . . . . . . : 192.168.6.1
   DHCP Server . . . . . . . . . . . : 192.168.6.1
   DNS Servers . . . . . . . . . . . : 10.200.215.254
                                       75.75.75.75
   NetBIOS over Tcpip. . . . . . . . : Enabled

 ---------------------------------------------------

---------------------------------

Fortinet DMZ interface:

IP/Net mask : 10.200.215.254/255.255.255.0

Policy: DMZ2Wan--- sources-all, dest-all,services-all  NAT enabled

No security profiles.

-----------------------------

Wireless router info: Internet: IP 10.200.215.1 subnet: 255.255.255.0 gtwy: 10.200.215.254 DNS1: 10.200.215.254 DNS2: 75.75.75.75 Lan: IP 192.168.6.1 mask: 255.255.255.0 DHCP - 192.168.6.20-192.168.6.30

[Toshi_Esumi]

Both 75.75.75.75 or 75.75.76.76 are refusing my query. Maybe because I'm not Comcast customer or not sending query from a Comcast IP. If you're Comcast customer, just call their support. Otherwise, simply change it to something else like Google 8.8.8.8/8.8.4.4, Verizon 64.6.64.6/64.6.65.6, etc.

It might not a good idea to set the same Comcast DNS IP as the secondary DNS IP for the device(wifi router?) while your FortiGate's use the same Comcast DNS, which seem to be the case for your setting. 

[hamza786]

Tried several different DNS servers. Even tried setting the DNS locally on the host connected to the wireless router. Not sure if I am missing a route or a policy somewhere??

[rwpatterson]

Perhaps you just need to allow recursion on the interface between the Internet and your DMZ. What firmware version are you currently running?

[hamza786]

Fortigate 60D v5.6.2

How do I do recursion on the interface between the internet and DMZ? Is there a way to debug/triage this problem further? Fortinet support is no help.

"Perhaps you just need to allow recursion on the interface between the Internet and your DMZ. What firmware version are you currently running?"