Solved

Simple question about DNS and firewalls

Posted on 2008-06-19
2
194 Views
Last Modified: 2010-04-07
This is a basic question about how DNS servers communicate with the outside world when firewalled.

My understanding is that DNS servers are supposed to be placed behind a hardware firewall. They should not be firewalled themselves. This allows them to communicate freely with machines in a local subnet.  

Suppose I have a collection of IIS servers with a bunch of websites. These websites use domain names and name resolution is being provided my DNS servers.

Given the fact that the boxes running DNS services are behind a firewall, there are one of two ways I can see how this works:

possibility a) all requests involving name resolution are being routed from the IIS server to my services running DNS. The IIS boxes are publicly exposed, the DNS boxes are not.

possiiblity b) there is some limited port open or communication between the DNS box and the outside world.

I'm finding this a bit confusing because if scenario a) is true it introduces a systemic dependency on those IIS boxes, and it also makes it hard to understand how widely distributed things involving DNS -- say, DFS file replication  -- works properly if the primary actors of that are behind hardware firewalls.

Thanks...
0
Comment
Question by:kennethfine
  • 2
2 Comments
 
LVL 58

Accepted Solution

by:
tigermatt earned 250 total points
ID: 21825215
I doubt either is true. If you don't have the DNS port 53 forwarded through the firewall to one of your DNS servers, then an external DNS system is resolving requests for the IP addresses of your IIS web servers. Only internal requests on the LAN will be resolved by the internal DNS servers because they are local and will be using the Active Directory DNS servers as their preferred servers.

Usually, you will have your DNS for external web domains hosted at either the web host, ISP or at a provider which you have brought in specifically to provide your DNS.

-tigermatt
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 21825291
Thanks kennethfine!
--tigermatt
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Synchronize a new Active Directory domain with an existing Office 365 tenant
Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question