• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 504
  • Last Modified:

How to setup a Secondary DNS server using Public IP instead of Private IP??

Hello every1,

I won't hide anything from you, I don't know much about setting up a secondary DNS server. There is something bugging me a lot. I have 2 w2k3 server on my network... one that I use as the primary, let's say DNS1, and the other one as a secondary server; DNS2.

Now, when I setup my zone transfer, I just can't use the Public IP (which doesn't make much sens to me). I had to set DNS1 to allow zone transfer to 192.168.1.2 (DNS2 Backnet IP) and then I could synchronize the 2 servers. I would like to know what I am doing wrong? I want to use my public IPs to sync my 2 servers. And if it is impossible... then why? And what would I do if I had my 2 servers on two different sites then????
0
sampar
Asked:
sampar
  • 4
  • 3
1 Solution
 
ACollyerCommented:
Are the two servers aware of their public IPs (i.e. are they explicitly configured on the servers and not using NAT)?

If not, and the zone transfer is attempting to go via your default gateway, it may be blocked there.


Could you run IPCONFIG /ALL on both boxes and paste the results here? (Obviously change/blank the public IPs if you aren't in a position to divulge such info.)
0
 
samparAuthor Commented:
Are the two servers aware of their public IPs (i.e. are they explicitly configured on the servers and not using NAT)?

>>> They are not using NAT as far as I know, each of them as a valid public IP address

If not, and the zone transfer is attempting to go via your default gateway, it may be blocked there.

Could you run IPCONFIG /ALL on both boxes and paste the results here? (Obviously change/blank the public IPs if you aren't in a position to divulge such info.)


DNS1
Frontnet adapter:
ip: xx.xx.xxx.250 (and many others valid public IP)
subnet: 255.255.248.0
gateway: xx.xx.xxx.1
DNS Servers: yyy.yyy.yyy.4 & yyy.yyy.yyy.5 (ISP DNS)

Backnet adapter
ip: 192.168.9.8
subnet:255.255.0.0
gateway: none
DNS servers: 192.168.2.1 & 192.168.2.2 (local DNS server)



DNS2
Frontnet adapter:
ip: xx.xx.xxx.248
subnet: 255.255.248.0
gateway: xx.xx.xxx.1
DNS Servers: yyy.yyy.yyy.4 & yyy.yyy.yyy.5 (ISP DNS)

Backnet adapter
ip: 192.168.9.9
subnet:255.255.0.0
gateway: none
DNS servers: 192.168.2.1 & 192.168.2.2 (local DNS server)


So, you see, I was trying to sync my zone between xx.xx.xxx.250 and xx.xx.xxx.248 but it never worked until I changed my settings (in the zone transfer tab) to the backnet IPs
0
 
ACollyerCommented:
Ok that looks fine. There are two things you should try here.

Firstly, ensure that DNS service on each box is listening on its public IP. In the DNS console, right click the server name --> properties --> interfaces (see first attached image.)
If they are not listening on the public IPs, enter them into the list. You might want to configure the Windows firewall (or your hardware firewall) to only allow connections between the two servers on port 53, as you may not want the whole world querying your servers on their public IPs.

Secondly, ensure that zone transfers between the two servers are permitted on their public IPs. Right click the zone --> properties --> zone transfers (see second attached image.)
In my image, I allow zone transfers to any servers listed as nameservers (see the nameservers tab), but you can specify the public IPs in this dialog instead if you like.
DNS-Server-Interfaces.png
DNS-Zone-Transfers.png
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
samparAuthor Commented:
DNS1 is listening on .250 (public IP)
DNS2 is listening on .248 (public IP)

DNS1 is behind my firewall
DNS2 is not

In my firewall, I got 2 rules:
Rule 1 - Incoming DNS: allow any  to DNS server on port 53 (TCP and UDP)
Rule 2 - Outgoing DNS: allow from DNS server to any on port 53 (TCP and UDP)

it still doesn't work. Any idea why?
0
 
samparAuthor Commented:
btw, i can ping dns1 to dns2 and vice versa using the public ip
0
 
samparAuthor Commented:
awww it's working now, somehow...

It is weird because, test1; I use the "Allow zone transfers Only to serveres listed on the Name Servers Tab" and in the name servers tab I got my dns1.domain.com xx.xx.xxx.248 entry. And that doesn't work

Now, on test2: I use the "Allow zone transfers Only to the following servers" and I add the xx.xx.xxx.248 ip. And it works....

At least i got something working and I am very close to want I truly want

thx for your help
0
 
ACollyerCommented:
You're welcome, thank you :)
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now