0

This maybe unusual question but I would like to find out if this is possible.

We have several security zones behind firewall, let's call them LAN, DMZ and Backend.

There is a DNS server (bind, servername is ns1.domain.com) in DMZ zone, set as split DNS.I.e. it resolves domain.com public addresses to the request made from the Internet and private NATed addresses for same domain.com domain to the requests coming from the LAN and Backend.

It all works fine, however now I am introducing Windows 2008 AD into the Backend as server base grows and managing SAM databases is not an option anymore.Windows domain name is DOMAIN.COM.I realise that this may be confusing setup but this is done to keep things simple in the naming department.
Naturally this requires using Windows DNS which is on the same AD.DOMAIN.COM server.
DNS zones on this server work fine and I have set up a forwarder for ns1.domain.com for any internet related queries.
Now the question. If I want to resolve host located in the DMZ NATed subnet from th windows host in the Backend(i.e. use internal part of the split brain DMZ) , how do I make sure that requests for whatever_is_not_in_windows_domain.com_zone".domain.com are forwarded to the internal split brain DMZ?Is it possible at all? I realise that I can hardcode them into the windows dns server zone, but this looks like a workaround, not a solution...
Hopefully I was clear enough :)

Improve this question

2 Answers 2

Reset to default
3

I don't think this is possible, AD.DOMAIN.COM believes it is the authoritative source for this domain and will respond with NXDOMAIN no matter what.
I would really advice you to create a subdomain to put your AD into. As your setup grows this will become a bigger problem and manually adding hosts to both zones doesn't seem like a nice task.

It would be possible to run a Active Directory with a BIND DNS server.
What you could do is merge the zones and allow updates from the AD.DOMAIN.COM server.
However this requires the DOMAIN.COM zone to be a dynamic zone.

Improve this answer
7
  • This is an interesting idea.Where can I read more about it?
    – Sergei
    Oct 8, 2010 at 10:20
  • 1
    technet.microsoft.com/en-us/library/dd316373.aspx#ECAA The only non-obvious option you will need to set in your zone is "check-names ignore;".
    – faker
    Oct 8, 2010 at 10:35
  • 2
    +1 - Naming your Active Directory domain "domain.com" is a mistake. You're going against Microsoft-recommended best practices. Running BIND for your DNS for the Active Directory domain is an option, but you still have an ugly situation. Be aware that, in order for Group Policy to work properly, the "domain.com" name must resolve to the IP address of the domain controller computer(s), for example.
    – Evan Anderson
    Oct 8, 2010 at 11:55
  • 1
    @Sergei - It's old, but the question in the comments never got answered. The answer is to use a subdomain for your Active Directory domain name. For example, you would name your AD domain "AD.example.com" instead of "example.com"; this would mean your server might have an FQDN of "server.ad.example.com". Using a subdomain of your public DNS domain makes certificates and naming easy while keeping your internal network and DNS isolated from the internet. This has no bearing at all on pre-Windows 2000 login using "example\username" and you can add "example.com" as an alternative UPN suffix.
    – Thomas
    Nov 8, 2017 at 17:56
  • 1
    Note that you should NEVER use an invalid TLD for your internal domain. "Example.local" is bad. You cannot buy certificates for these names and it will completely break many Windows services, requiring lots of extra maintenance. Here is a MS wiki article with more information: social.technet.microsoft.com/wiki/contents/articles/…
    – Thomas
    Nov 8, 2017 at 17:58
1

I don't think this is possible. The backend Windows dns server is authoratative for domain.com and therefore won't forward requests for domain.com to another dns server. I think your only choice is to add static entries for the DMZ machines into the backend domain.com zone.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .