Solved

Simple question about DNS and firewalls

Posted on 2008-06-19
2
191 Views
Last Modified: 2010-04-07
This is a basic question about how DNS servers communicate with the outside world when firewalled.

My understanding is that DNS servers are supposed to be placed behind a hardware firewall. They should not be firewalled themselves. This allows them to communicate freely with machines in a local subnet.  

Suppose I have a collection of IIS servers with a bunch of websites. These websites use domain names and name resolution is being provided my DNS servers.

Given the fact that the boxes running DNS services are behind a firewall, there are one of two ways I can see how this works:

possibility a) all requests involving name resolution are being routed from the IIS server to my services running DNS. The IIS boxes are publicly exposed, the DNS boxes are not.

possiiblity b) there is some limited port open or communication between the DNS box and the outside world.

I'm finding this a bit confusing because if scenario a) is true it introduces a systemic dependency on those IIS boxes, and it also makes it hard to understand how widely distributed things involving DNS -- say, DFS file replication  -- works properly if the primary actors of that are behind hardware firewalls.

Thanks...
0
Comment
Question by:kennethfine
  • 2
2 Comments
 
LVL 58

Accepted Solution

by:
tigermatt earned 250 total points
ID: 21825215
I doubt either is true. If you don't have the DNS port 53 forwarded through the firewall to one of your DNS servers, then an external DNS system is resolving requests for the IP addresses of your IIS web servers. Only internal requests on the LAN will be resolved by the internal DNS servers because they are local and will be using the Active Directory DNS servers as their preferred servers.

Usually, you will have your DNS for external web domains hosted at either the web host, ISP or at a provider which you have brought in specifically to provide your DNS.

-tigermatt
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 21825291
Thanks kennethfine!
--tigermatt
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

912 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now