Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have some Windows XP machines that are behind NAT, will all services still work as normal such as file sharing, printing, etc.

The setup would be something like NAT`ed to (PAT really I guess), where the 2003 domain controller, files shares, printers etc would be on the network.

I am aware of bridging, but I am curious if this would work okay.

share|improve this question
IPSec tunneling? – Bart Silverstrim Jan 27 '10 at 13:09
Bart: Wireless. – Kyle Brandt Jan 27 '10 at 13:14
up vote 6 down vote accepted

Yes, this will work. In practice, I have found that 99% of access scenarios are client-pull-from-server.

Where it could break is if you are used to using MMC to manage your workstations from your server, but if you don't do that already, it's no biggie.

One gotcha to look out for is that you need to make sure your clients have access to your domain controller's DNS server. So if your NAT box routing the network is also running its own DHCP server, make sure it hands out the IP address of your domain controller ( in DHCP, or if it runs its own DNS forwarder, make sure the NAT box uses your domain controller as upstream DNS.

Honestly — 9 times out of 10 if your client can’t converse with the server, it’s a DNS issue, not a NAT issue.

As a general recommendation (slightly off-topic), I highly recommend you start to look at IPv6 deployment. Active Directory and SMB over IPv6 is not supported with Server 2003 or Windows XP, but is fully supported in Windows Vista and Server 2008, so is something to think about. (With DirectAccess and Agile VPN, this is made a lot easier than you would otherwise think.)

share|improve this answer

Normally it's the client computer which connects to the domain controller, so yes, this could work through a NAT.

It would be quite unsupported and a royal pain to manage, though.

share|improve this answer

There appears to be a minimal support article about it here.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.