Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Simple question about DNS and firewalls

Posted on 2008-06-19
2
Medium Priority
?
201 Views
Last Modified: 2010-04-07
This is a basic question about how DNS servers communicate with the outside world when firewalled.

My understanding is that DNS servers are supposed to be placed behind a hardware firewall. They should not be firewalled themselves. This allows them to communicate freely with machines in a local subnet.  

Suppose I have a collection of IIS servers with a bunch of websites. These websites use domain names and name resolution is being provided my DNS servers.

Given the fact that the boxes running DNS services are behind a firewall, there are one of two ways I can see how this works:

possibility a) all requests involving name resolution are being routed from the IIS server to my services running DNS. The IIS boxes are publicly exposed, the DNS boxes are not.

possiiblity b) there is some limited port open or communication between the DNS box and the outside world.

I'm finding this a bit confusing because if scenario a) is true it introduces a systemic dependency on those IIS boxes, and it also makes it hard to understand how widely distributed things involving DNS -- say, DFS file replication  -- works properly if the primary actors of that are behind hardware firewalls.

Thanks...
0
Comment
Question by:kennethfine
  • 2
2 Comments
 
LVL 58

Accepted Solution

by:
tigermatt earned 1000 total points
ID: 21825215
I doubt either is true. If you don't have the DNS port 53 forwarded through the firewall to one of your DNS servers, then an external DNS system is resolving requests for the IP addresses of your IIS web servers. Only internal requests on the LAN will be resolved by the internal DNS servers because they are local and will be using the Active Directory DNS servers as their preferred servers.

Usually, you will have your DNS for external web domains hosted at either the web host, ISP or at a provider which you have brought in specifically to provide your DNS.

-tigermatt
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 21825291
Thanks kennethfine!
--tigermatt
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

824 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question