Solved

DNS / Active Directory with external router/WAN connection?

Posted on 2003-12-05
10
948 Views
Last Modified: 2012-08-13
Guys -

It's been quite a while since I've set up AD/DNS, and that was in a corp. environment with a networking group to do the DNS stuff...

I have donated my time to a museaum to set up new computers for them.  Server is WIN2k running AD / integrated DNS.

Here is my config:  WAN/Router/firewall (DSL line).  Servers and workstations will have static inside (private) addresses.

My question - how to make the SERVER DNS provide OUTSIDE resoulution (internet sites like this one!) to the users inside?  I know this is an easy one for you guys.

Thanks.
John
0
Comment
Question by:Bigjohn-s
  • 4
  • 3
  • 3
10 Comments
 
LVL 6

Expert Comment

by:Casca1
Comment Utility
You really don't WANT to; It's possible, but you have raised the threat level for your AD in doing so.
You best bet is to run a firewall and a DMZ, place your Webstuff and external DNS there, and the Museum intranet inside the firewall.
A little different configuration, but much safer.
0
 
LVL 2

Author Comment

by:Bigjohn-s
Comment Utility
I must have not been clear.

I want to point the workstations to the internal DNS and have the internal DNS get its information from the WAN regarding locations of websites.  WE're not hosting a site on premises.

so - user at PC 10.0.0.5 has DNS set to server (10.0.0.20).  I've only got the default configuration for DNS that happens when you install AD.  I think that has ONE forward lookup zone.

What do I need to do to make certain that user at PC 10.0.0.5 can: a)authenticate with the local AD server (only one server on this net...), and surf the web?

John
0
 
LVL 13

Expert Comment

by:ocon827679
Comment Utility
Use a Forwarder in the DNS Properties.  You want to configure the forwarder to be the DNS server of your ISP.  This way your DNS will resolve internal resources and if a user wants out on the Internet, DNS querys will be forwarded to the ISP for resolution.
0
 
LVL 2

Author Comment

by:Bigjohn-s
Comment Utility
Is that correct?  My fear was that 'forwarder' would make my DNS tell the 'WORLD' about stuff inside - thus creating security problem.
0
 
LVL 13

Expert Comment

by:ocon827679
Comment Utility
No - a forwarder will "Forward" requests that cannot be resolved locally.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 6

Assisted Solution

by:Casca1
Casca1 earned 20 total points
Comment Utility
Ocon answered that correctly. Additionally, if you have the "." listing in your DNS console, you will want to delete it. That "." tells your DNS it's the Root server. While your server may be the root for your network, it is not THE root. 8-)
If you don't remove the root zone, it will cause you ALL kinds of issues.
Once you do that and setup forwarding, you can set each client to use the DNS server, and it will work properly.
Ummm, any reason NOT to use DHCP? It makes your life easier in the extreme, and is REAL easy to set up in 2K.
0
 
LVL 2

Author Comment

by:Bigjohn-s
Comment Utility
ok.  2 questions:

how do I add this forwarder, and where do I look in the DNS for the "."


I'm not using DHCP because it's a very small operation (3 users one server) and I don't want anyone plugging into the network and getting an address.
0
 
LVL 13

Accepted Solution

by:
ocon827679 earned 50 total points
Comment Utility
On the server acting as your DNS.  Open the DNS admin console.  Start - Programs - Administrative Tools - DNS

Right-click on the server name and select Properties.
Open the "forwarders" tab.
Check the box labeled Forwarders.
Input the IP address of your ISP's sDNS server.

I believe that you will find the "." in the forward lookup zone of the DNS admin console.  If it is there, delete it.  If not, don't worry about it.
0
 
LVL 2

Author Comment

by:Bigjohn-s
Comment Utility
thanks guys
0
 
LVL 6

Expert Comment

by:Casca1
Comment Utility
Nono, Thank you!
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Mapping Drives using Group policy preferences Are you still using old scripts to map your network drives if so this article will show you how to get away for old scripts and move toward Group Policy Preference for mapping them. First things f…
#Citrix #POC #XenDesktop #vCenter #VMware #ESX
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now