Solved

dns issue

Posted on 2009-05-20
15
184 Views
Last Modified: 2012-05-07
AD integrated DNS on windows 2003 server.  website is hosted offsite.  want to be able to get to userpages built into website by going to username.domain.com.  outside of network this works just fine. inside the network the sites do not resolve.  any help would be appreciated.
0
Comment
Question by:jakgumbo
  • 6
  • 6
  • 2
  • +1
15 Comments
 
LVL 18

Expert Comment

by:flyingsky
Comment Utility
when you are inside of your network, are you about the resolve the domain name (username.domain.com) to IP address?
0
 
LVL 82

Expert Comment

by:oBdA
Comment Utility
Your internal network is probably identical with your internet domain name. In this case, your only choice is to create individual host (A) entries "username" in your internal DNS zone, pointing to the respective external IP addresses.
0
 

Author Comment

by:jakgumbo
Comment Utility
when i try to resolve username.domain.com  i get "host not found",  my internal domain is also domain.com
0
 

Author Comment

by:jakgumbo
Comment Utility
@sage wow, there isnt a better way to do this?
0
 
LVL 18

Expert Comment

by:flyingsky
Comment Utility
that's exatly what oBdA pointed out. all you need to do is set up a host record entry in your DNS, pointing username.domain.com to the correct public IP address
0
 

Author Comment

by:jakgumbo
Comment Utility
so for 5000 users i would need to set this up individually for each person?
0
 
LVL 18

Expert Comment

by:flyingsky
Comment Utility
no. only on your DNS server, not client
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 

Author Comment

by:jakgumbo
Comment Utility
right but on my dns server i need to add 5000 entries??
0
 
LVL 18

Expert Comment

by:flyingsky
Comment Utility
well, if you have 5000 users, then that's not a good idea.
a way to work around is, you can setup another machine, which is NOT part of your AD domain, use ISP dns server, then remote control that machine to manage this.
0
 

Author Comment

by:jakgumbo
Comment Utility
im not sure i understand you.  setup another machine, which is not part of my ad domain.....?
0
 
LVL 18

Expert Comment

by:flyingsky
Comment Utility
I mean a stand alone machine, don't join to your AD domain.
0
 
LVL 1

Expert Comment

by:halonx
Comment Utility
If all of the username.domain.com DNS entries need to point to the same IP address / hostname then setup a wildcard host on your AD server.  With the wildcard you can have *.domain.com forward to your other host and then for everything that you don't want to go to the host you can specify.

The host side doing the username.domain.com hosting would have to be able to handle a user not existing, but the URL exists( ie:  baduser.domain.com would resolve.. ).
0
 

Author Comment

by:jakgumbo
Comment Utility
ok, i added a wildcard, but now when i do an nslookup domain.com  i get by active directory computers and the external IP address.
0
 
LVL 82

Accepted Solution

by:
oBdA earned 500 total points
Comment Utility
Moving that to a stand-alone machine won't help any; your domain members *HAVE* to use *EXCLUSIVELY* DNS servers that are authoritative for your AD domain name. A DNS server that is authoritative for a zone will, for the obvious reason, never forward any queries, because by definition, there can't be any records in that zone that this DNS server doesn't know.
Using a wildcard won't work for the reason you've just discovered: your AD dns name *HAS* to resolve to your DCs *ONLY*.
Renaming an AD domain isn't anything that's done lightly.
So if you want to avoid having to add 5000 host records (though you could automate that with dnscmd.exe), your only option is to move your external user sites to a subdomain, for example users.domain.com, and let the users go to username.users.domain.com.
Or redesign that external website, move it to something like users.domain.com, and let the users log on with their name.
0
 
LVL 18

Expert Comment

by:flyingsky
Comment Utility
my suggestion is set up a stand alone machine (not part of any AD domain), make sure it can access the proper username.domain.com (that means it needs to use other DNS server, like ISP's, not the DNS server in the current AD domain). Then just remote control this machine to manage all 5000 of users.
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Suggested Solutions

Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now