Solved

Simple question about DNS and firewalls

Posted on 2008-06-19
2
190 Views
Last Modified: 2010-04-07
This is a basic question about how DNS servers communicate with the outside world when firewalled.

My understanding is that DNS servers are supposed to be placed behind a hardware firewall. They should not be firewalled themselves. This allows them to communicate freely with machines in a local subnet.  

Suppose I have a collection of IIS servers with a bunch of websites. These websites use domain names and name resolution is being provided my DNS servers.

Given the fact that the boxes running DNS services are behind a firewall, there are one of two ways I can see how this works:

possibility a) all requests involving name resolution are being routed from the IIS server to my services running DNS. The IIS boxes are publicly exposed, the DNS boxes are not.

possiiblity b) there is some limited port open or communication between the DNS box and the outside world.

I'm finding this a bit confusing because if scenario a) is true it introduces a systemic dependency on those IIS boxes, and it also makes it hard to understand how widely distributed things involving DNS -- say, DFS file replication  -- works properly if the primary actors of that are behind hardware firewalls.

Thanks...
0
Comment
Question by:kennethfine
  • 2
2 Comments
 
LVL 58

Accepted Solution

by:
tigermatt earned 250 total points
ID: 21825215
I doubt either is true. If you don't have the DNS port 53 forwarded through the firewall to one of your DNS servers, then an external DNS system is resolving requests for the IP addresses of your IIS web servers. Only internal requests on the LAN will be resolved by the internal DNS servers because they are local and will be using the Active Directory DNS servers as their preferred servers.

Usually, you will have your DNS for external web domains hosted at either the web host, ISP or at a provider which you have brought in specifically to provide your DNS.

-tigermatt
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 21825291
Thanks kennethfine!
--tigermatt
0

Join & Write a Comment

Introduction You may have a need to setup a group of users to allow local administrative access on workstations.  In a domain environment this can easily be achieved with Restricted Groups and Group Policies. This article will demonstrate how to…
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now