hornbyp - thanks for your further questions...

>It's worth configuring Syslog on a PC if you don't already have it - this is where all the Router debug info appears. It will help you spot if it's stuff like the 'DoS defence' getting involved.

OK - I'll try and set that up.

>Also, can you clarify this statement "when I tried nslookup it did not get a response" ... That sounds for all the world, like you had no working/accessible DNS server available to you at that point. Which one was it trying to use?

That's correct. DNS was again down. We currently have all DNS set to 8.8.8.8 Primary and 8.8.4.4 secondary. When it is working the response is as per my previous post.

>Also, how is the DNS server setting conveyed to your PC clients. Via DHCP? or static? I assume the former - is the 2820 the DHCP server?

DNS is being provided over DHCP by the 2820 with those above settings being "forced" by the check box on the LAN settings.

There are some static IP's on servers and a laser printer, also set with the above DNS.

On the LAN to complete the picture we use TFTP32 (by P Journin) to provide PXE boot services and DNS is also set in that - but bear in mind the connection through the Draytek still fails even when the entire LAN is disconnected so it has to be something between the Draytek and BT service.

andrewc wrote: OK - I'll try and set that up.

Draytek's SYSLOG Utility is here: http://www.draytek.co.uk/component/jdownloads/send/336-software/694-syslog-454-win
(I think DoS messages will be sent to the SYSLOG server by default; you can configure others (and the address of the server) in (System Maintenance >> Syslog/Mail Alert Setup)

He also wrote: That's correct. DNS was again down. We currently have all DNS set to 8.8.8.8 Primary and 8.8.4.4 secondary.

When it fails, would you humour me and check the output of Ipconfig /all and tracert -d 8.8.8.8
(Just to double-check that the PC really is using the DNS you've configured and what sort of connectivity there is to it.)

Ipconfig /all on the PCs always reports the DNS addresses (at least the primary) correctly. It is just that it doesn't seem to find them via lookup when you go to ping the domain by name or browse a website.

It is interesting that it always works for a while before failing which suggests to me the possibility that it is being blocked after a certain number of tries. We'll see what it does today with the UDP DoS unchecked - I am not in the office today but have asked a colleague to report back on it.

And I'll try the tracert with parameter as you suggest and get bsck with that result.

I just had another thought...

it's probably worthwhile issuing an "ipconfig /flushdns" before any DNS tests - just to ensure you don't get a cached response. (Seemingly, you can no longer stop the "DNS Client" service on WIndows 10).

Hi hornbyp

Here are the outputs you requested. Note that I have logged into the Draytek via VPN to get these, so ignore my local adaptors and look at PPP adapter TT-NB: And the Gateway is not usually blank when I am in the office - it is the Draytek IP.

C:\Users\user1>ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\user1>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : DELLXPS
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Mixed
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
Physical Address. . . . . . . . . : D4-BE-D9-92-FF-0F
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::38d4:f3c2:1198:93b7%2(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.35(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 18 January 2018 10:41:08
Lease Expires . . . . . . . . . . : 11 March 2018 08:55:55
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 47496921
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-20-94-99-25-D4-BE-D9-92-FF-0F
DNS Servers . . . . . . . . . . . : 8.8.8.8
194.168.8.100
NetBIOS over Tcpip. . . . . . . . : Enabled

PPP adapter TT-NB:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TT-NB
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 172.16.38.17(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 0.0.0.0
DNS Servers . . . . . . . . . . . : 8.8.8.8
8.8.4.4
NetBIOS over Tcpip. . . . . . . . : Enabled

C:\Users\user1> tracert -d 8.8.8.8

Tracing route to 8.8.8.8 over a maximum of 30 hops

1 41 ms 36 ms 38 ms 172.16.38.1
2 59 ms 53 ms 51 ms 81.134.160.1
3 54 ms 53 ms 54 ms 213.120.178.141
4 58 ms 54 ms 54 ms 213.120.177.98
5 54 ms 54 ms 52 ms 213.120.178.67
6 53 ms 55 ms 53 ms 217.41.168.107
7 52 ms 54 ms 53 ms 109.159.249.92
8 53 ms 54 ms 66 ms 109.159.249.39
9 54 ms 61 ms 55 ms 213.121.193.179
10 54 ms 65 ms 54 ms 195.99.126.185
11 54 ms 55 ms 56 ms 108.170.246.225
12 56 ms 54 ms 57 ms 209.85.246.103
13 55 ms 57 ms 61 ms 8.8.8.8

Trace complete.

Quite a lot of hops... Hope that helps.

That all looks perfectly reasonable - though of course, it was working normally at the time. Assuming the SYSLOG doesn't show your issue first, it will be interesting to see what it says in failure mode.