Solved

using dns in dmz for queries.  Good Idea?

Posted on 2014-07-22
2
464 Views
Last Modified: 2014-07-29
Just wanted some general ideas about preventing AD servers from DNS lookups (just forwarding) and instead use a DNS server in the DMZ (probably Linux) doing the actual lookups.  Our security guy wants to do this and was wondering what the implications are.

Has anyone had any good or bad experiences with this kind of setup?  

I assume it's not that common any more?
0
Comment
Question by:billFmurray
2 Comments
 
LVL 56

Expert Comment

by:Cliff Galiher
ID: 40212825
Well, many things in AD *need* DNS to work right, so getting such a setup would still require the DMZ DNS server to talk to the AD DNS server, virtually eliminating any security benefit. I'm not sure I understand the purpose.
0
 
LVL 26

Accepted Solution

by:
DrDave242 earned 500 total points
ID: 40215650
Just wanted some general ideas about preventing AD servers from DNS lookups (just forwarding) and instead use a DNS server in the DMZ (probably Linux) doing the actual lookups.
Are you referring to external lookups (i.e., resolution of internet names)? DNS is used extensively for internal lookups by everything in the domain, so you wouldn't want to restrict that, but yes, you can restrict external lookups if you'd like. Your domain controllers can be configured to use the DMZ server as their only forwarder, and that server can then do the dirty work. You can then configure the firewall so that only DNS queries from your DCs are allowed to pass from the LAN to the DMZ, and only DNS queries from the DMZ server are allowed to pass through to the internet.

One disadvantage that I can see is that there's a single point of failure anytime you use only one forwarder: if your DMZ DNS server goes down, nobody in the domain will be able to get to the internet until it comes back up or you do a bit of reconfiguration.
0

Featured Post

[Webinar] Disaster Recovery and Cloud Management

Learn from Unigma and CloudBerry industry veterans which providers are best for certain use cases and how to lower cloud costs, how to grow your Managed Services practice in IaaS clouds, and how to utilize public cloud for Disaster Recovery

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now