DNS / Active Directory with external router/WAN connection?

Guys -

It's been quite a while since I've set up AD/DNS, and that was in a corp. environment with a networking group to do the DNS stuff...

I have donated my time to a museaum to set up new computers for them.  Server is WIN2k running AD / integrated DNS.

Here is my config:  WAN/Router/firewall (DSL line).  Servers and workstations will have static inside (private) addresses.

My question - how to make the SERVER DNS provide OUTSIDE resoulution (internet sites like this one!) to the users inside?  I know this is an easy one for you guys.

Thanks.
John
LVL 2
Bigjohn-sAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Casca1Commented:
You really don't WANT to; It's possible, but you have raised the threat level for your AD in doing so.
You best bet is to run a firewall and a DMZ, place your Webstuff and external DNS there, and the Museum intranet inside the firewall.
A little different configuration, but much safer.
0
Bigjohn-sAuthor Commented:
I must have not been clear.

I want to point the workstations to the internal DNS and have the internal DNS get its information from the WAN regarding locations of websites.  WE're not hosting a site on premises.

so - user at PC 10.0.0.5 has DNS set to server (10.0.0.20).  I've only got the default configuration for DNS that happens when you install AD.  I think that has ONE forward lookup zone.

What do I need to do to make certain that user at PC 10.0.0.5 can: a)authenticate with the local AD server (only one server on this net...), and surf the web?

John
0
ocon827679Commented:
Use a Forwarder in the DNS Properties.  You want to configure the forwarder to be the DNS server of your ISP.  This way your DNS will resolve internal resources and if a user wants out on the Internet, DNS querys will be forwarded to the ISP for resolution.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Bigjohn-sAuthor Commented:
Is that correct?  My fear was that 'forwarder' would make my DNS tell the 'WORLD' about stuff inside - thus creating security problem.
0
ocon827679Commented:
No - a forwarder will "Forward" requests that cannot be resolved locally.
0
Casca1Commented:
Ocon answered that correctly. Additionally, if you have the "." listing in your DNS console, you will want to delete it. That "." tells your DNS it's the Root server. While your server may be the root for your network, it is not THE root. 8-)
If you don't remove the root zone, it will cause you ALL kinds of issues.
Once you do that and setup forwarding, you can set each client to use the DNS server, and it will work properly.
Ummm, any reason NOT to use DHCP? It makes your life easier in the extreme, and is REAL easy to set up in 2K.
0
Bigjohn-sAuthor Commented:
ok.  2 questions:

how do I add this forwarder, and where do I look in the DNS for the "."


I'm not using DHCP because it's a very small operation (3 users one server) and I don't want anyone plugging into the network and getting an address.
0
ocon827679Commented:
On the server acting as your DNS.  Open the DNS admin console.  Start - Programs - Administrative Tools - DNS

Right-click on the server name and select Properties.
Open the "forwarders" tab.
Check the box labeled Forwarders.
Input the IP address of your ISP's sDNS server.

I believe that you will find the "." in the forward lookup zone of the DNS admin console.  If it is there, delete it.  If not, don't worry about it.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Bigjohn-sAuthor Commented:
thanks guys
0
Casca1Commented:
Nono, Thank you!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Operating Systems

From novice to tech pro — start learning today.