Solved

using dns in dmz for queries.  Good Idea?

Posted on 2014-07-22
2
492 Views
Last Modified: 2014-07-29
Just wanted some general ideas about preventing AD servers from DNS lookups (just forwarding) and instead use a DNS server in the DMZ (probably Linux) doing the actual lookups.  Our security guy wants to do this and was wondering what the implications are.

Has anyone had any good or bad experiences with this kind of setup?  

I assume it's not that common any more?
0
Comment
Question by:billFmurray
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 58

Expert Comment

by:Cliff Galiher
ID: 40212825
Well, many things in AD *need* DNS to work right, so getting such a setup would still require the DMZ DNS server to talk to the AD DNS server, virtually eliminating any security benefit. I'm not sure I understand the purpose.
0
 
LVL 26

Accepted Solution

by:
DrDave242 earned 500 total points
ID: 40215650
Just wanted some general ideas about preventing AD servers from DNS lookups (just forwarding) and instead use a DNS server in the DMZ (probably Linux) doing the actual lookups.
Are you referring to external lookups (i.e., resolution of internet names)? DNS is used extensively for internal lookups by everything in the domain, so you wouldn't want to restrict that, but yes, you can restrict external lookups if you'd like. Your domain controllers can be configured to use the DMZ server as their only forwarder, and that server can then do the dirty work. You can then configure the firewall so that only DNS queries from your DCs are allowed to pass from the LAN to the DMZ, and only DNS queries from the DMZ server are allowed to pass through to the internet.

One disadvantage that I can see is that there's a single point of failure anytime you use only one forwarder: if your DMZ DNS server goes down, nobody in the domain will be able to get to the internet until it comes back up or you do a bit of reconfiguration.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
This article shows the method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question