I'm stumped!

[Sander Rossel]

The sub domain is any customer location code. So it's loc1.localhost or loc2.localhost. I've thought about the hosts file, but that won't explain why it works in my browser, but I can't ping it and why it works at home, but not at the office and that my coworker has a varying mileage. It doesn't work in Azure either, which is even weirder, since all subdomains are registered in a DNS within a "proper" domain.

Best, Sander Azure DevOps Succinctly (free eBook) Azure Serverless Succinctly (free eBook) Migrating Apps to the Cloud with Azure arrgh.js - Bringing LINQ to JavaScript

[Sander Rossel]

RainHat wrote:

so I guess that is why it is elephanting when trying to resolve a sub domain from it

But only under specific (unknown) circumstances, like being at the office or having a VPN. I've thought about the hosts file, but that won't explain why it works in my browser, but I can't ping it and why it works at home, but not at the office and that my coworker has a varying mileage. It doesn't work in Azure either, which is even weirder, since all subdomains are registered in a DNS within a "proper" domain.

Best, Sander Azure DevOps Succinctly (free eBook) Azure Serverless Succinctly (free eBook) Migrating Apps to the Cloud with Azure arrgh.js - Bringing LINQ to JavaScript

[Sander Rossel]

I've thought about the hosts file, but that won't explain why it works in my browser, but I can't ping it and why it works at home, but not at the office and that my coworker has a varying mileage. It doesn't work in Azure either, which is even weirder, since all subdomains are registered in a DNS within a "proper" domain.

Best, Sander Azure DevOps Succinctly (free eBook) Azure Serverless Succinctly (free eBook) Migrating Apps to the Cloud with Azure arrgh.js - Bringing LINQ to JavaScript

[Mircea Neacsu]

I think at least some browsers (Chrome, I'm looking at you!) have their own DNS resolver. VPN adds another level of weirdness and anyway localhost is not a valid domain name. Are you trying to solve all the possible interactions between these parts or you just want your app to work? If it's the first one, I'd like to hear the result, maybe in an article or tip here. If it's the second, just add a line to your hosts file. It has the highest priority in the DNS resolving order[^] and it just works.

Mircea

[honey the codewitch]

I think your workplace might have some dodgy network group policies/filters.

Check out my IoT graphics library here: https://honeythecodewitch.com/gfx And my IoT UI/User Experience library here: https://honeythecodewitch.com/uix

[jochance]

If the subdomains are also located on different subnets things get more hairy than a Minoxidil spill. Running things local, all should work with the host file entries for 'real' domains... .myapp and .myappservice is probably what I would pick. I think maybe there is confusion about the routing happening server-side vs client? Which really just depends on the code. If the code to hit the service is c# server-side vs something like an inline json call from js, then which DNS resolution (and which hosts file, client v server) is getting used would be different.

[jochance]

When you say you cannot ping it, do you mean you get no response or you get no name resolution? Try powershells from the machines where the app is running if you can...

Test-NetConnect -p

... I may be off on some of that syntax.

[jochance]

I'm suspicious of that too, especially with new AI network monitors/thwarters... But it would be super weird for them to muck with overriding the hosts file though?

[honey the codewitch]

I amended my comment to include group policies, which can do strange things to a machine.

Check out my IoT graphics library here: https://honeythecodewitch.com/gfx And my IoT UI/User Experience library here: https://honeythecodewitch.com/uix

[jochance]

That's true... and which domain you are logging onto and whether you're "inhouse" or ingressing through a VPN or something could change which get applied. It could send you to different DNS servers (to help hide internal resources in domains that were more "edge"-closer to DMZ).

[Sander Rossel]

The only difference is a different Wi-Fi (shared with other tenants). We don't have a work network, domain controller, etc.

Best, Sander Azure DevOps Succinctly (free eBook) Azure Serverless Succinctly (free eBook) Migrating Apps to the Cloud with Azure arrgh.js - Bringing LINQ to JavaScript

[honey the codewitch]

Well I guess the good news is that simplifies the situation considerably. The bad news is I have no idea what your next troubleshooting move should be.

Check out my IoT graphics library here: https://honeythecodewitch.com/gfx And my IoT UI/User Experience library here: https://honeythecodewitch.com/uix

[kmoorevs]

It's not the Azure network gateway is it? Last weekend working away from home and needed to rdc into an Azure VM meant that I had to add the IP address where I was connected to the inbound Accept rules in order to connect. Just a thought... Good luck!

"Go forth into the source" - Neal Morse "Hope is contagious"

[jschell]

Sander Rossel wrote:

but my web app can't access the service ("no such host is known")...("no such host is known").

This is not a "service" problem. It is a connectivity problem. So you need to diagnose that and stop focusing on the service. In the modern era you can and probably should always start with diagnosing connectivity using telnet. Since all modern sites use IP/TCP telnet is an excellent tool to test that. If you can connect via telnet then there is no connectivity issue. If not then there is. It is just that simple. Nothing else matters in that context. For example SSL/TLS has no impact on it. Looks like you are also using a host name and not an IP address. You can use a DNS lookup tool like 'nslookup' to determine the IP. DNS processing is a separate service which can fail all by itself. If you can verify the look up then after that you should use the IP only since it removes that extra service lookup (and failure possibility.) Again you use telnet with the IP to check. Now if you verify that it is not a connectivity issue then you can look at the service. For example firewall rules can block specific http requests. Also commenting on the thing about the hosts file and browsers. That was curious so I looked that up and found the following which doesn't make it all that clear what might be expected. https://stackoverflow.com/questions/42636711/google-chrome-ignoring-hosts-file[^] But what is clear is that using the IP makes al of that irrelevant. As one other bit of advice when using the browser - do not leave any open browser windows when testing. So no other sites. Despite things like incognito it still caches stuff. So every single browser must be closed. Or at least that was true a few years ago.

[jmaida]

It's the devil's work. :confused:

"A little time, a little trouble, your better day" Badfinger

[Jeremy Falcon]

Sander Rossel wrote:

When I'm at home, it works. When I'm at home and on VPN it doesn't work. It works with and without VPN for my coworker, but only from home. At the office, it doesn't work with or without VPN for both of us.

When something is all over the place like this, it's best to remove as many variables as possible. As such, if not yet done, a traceroute should be done in each and every environment both on and off the VPN. It could be anything from your coworker updating his hosts file without saying so or even a regional thing where you're hitting a different server. Who knows, but a traceroute will help figure that out.

Sander Rossel wrote:

We've deployed both in an Azure app service with the subdomain properly registered in the DNS and a valid certificate.

Exactly how though? A local or localhost domain generally doesn't go through DNS. I mean it can, but it's typically considered private. Is this a public DNS server or something internal only?

Sander Rossel wrote:

When I remove the subdomain everything works.

This is what I'm guessing the issue is. It's just a guess, but in DNS lingo a subdomain is a _typically_ CNAME. A top level domain is an A record usually. If you try to add a "sub domain" as an A/SOA record, that's considered advanced and not needed for most situations where you're running things on the same server. So perhaps Azure (assuming this is a public DNS server) just isn't happy with the way it was entered.

Jeremy Falcon

[Jeremy Falcon]

Sander Rossel wrote:

I've thought about the hosts file, but that won't explain why it works in my browser, but I can't ping it and why it works at home, but not at the office and that my coworker has a varying mileage.

A lot of servers disable pings to help prevent a DoS. Unless you're positive your server accepts pings, you'd be better of doing an ns lookup to see if it's going to be resolved or not.

Jeremy Falcon

[Jeremy Falcon]

Also, you should flush the DNS cache on every machine that attempts to access anything before even thinking about troubleshooting. DNS propagation isn't too long of a wait, but it's most certainly not instant. So, if you're debugging something, always flush your DNS cache first. For Windows it's ipconfig /flushdns. Also, it wouldn't hurt to know the TTL for the DNS server in question for each machine. This assuming you're not using your ISPs DNS server, which you most likely are. Although some ISPs will list their TTL. Note, this doesn't apply to a host file, but it most certainly does for a DNS server.

Jeremy Falcon

[Stefan Schmiedl]

A while ago, I had a test site setup with both A and AAAA records in DNS. Worked fine "from home", failed to connect "via VPN". Guess what: My VPN config had IPv6 disabled, but still tried to connect using the AAAA IPv6 address.

[Peter Adam]

tracert shows different paths to the domain?