Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just wondering why a Domain Controller has a public IP address?

share|improve this question
up vote 6 down vote accepted

Well, speaking as a guy who works for a company that, until earlier this year, had external ips for the whole company. I mean, the crappy pc in the break room? External ip. Junky laser printer in an office that hasn't been used in 5 years? External ip. Gotta get your money's worth out of that /16 block...

This is not a problem...There is nothing inherently wrong with having an externally routable ip...Hell, ip6 is based on the idea that that is the right way to do things. The real question is how much protection do you have on that machine? Because a domain controller is a fragile beast, and it shouldn't be allowed to play on the internet unsupervised. If it's compromised, your whole domain is compromised, all trusts are compromised, it's just a nightmare.

So make sure it's got plenty of firewalls and filters, and don't worry about the external ip.

share|improve this answer
+1. Using a publicly routable ip scheme internally doesn't make the systems any more prone to risk than using non-routable ip addresses IMHO. I inherited a network that uses publicly routable ip addresses, but we use good security practices, only allow needed services to transit the firewall (SMTP, HTTP, etc.) and regularly monitor and test for vulnerabilities and attacks, so I've never been able to justify the need to re-address our internal network to one of the RFC 1918 ranges. It's a little unorthodox these days to use publicly routable ip addresses internally, but it's not wrong. – joeqwerty Mar 19 '10 at 2:49

All of our internal systems use public addresses. If you're concerned about network exposure, you may be more interested in the firewall. Even with a private IP, it is still possible for a rule to exist that allows traffic that should not be exposed to the internet.

share|improve this answer
+1. See my comment to Satanicpuppy's answer. – joeqwerty Mar 19 '10 at 2:49

One possibility is that someone wants AD public facing for authentication or directory services. If it's a machine on an internal network then my argument is that it's either a collosal mistake or an incompetent firewall admin.

A little more explanation of your environment would help to give better answers, unless you're wondering just in general.

share|improve this answer

I assume by a public IP you mean an externally routable IP, so accessible from the internet.

A domain controller does not have to have a public IP, and it is best that it does not. You domain controller is the directory of all the user and computer accounts on your network and should be kept as secure as possible. Keeping your DC off the public network is one way to help that.

Obviously, this is not always possible. Many small companies have a single server doing everything for them (such as Small Business Server) and if that is the case then they may need to have a DC with a public IP.

share|improve this answer
Why would it need the public IP on the server's interface? Shouldn't it have a private IP and have services routed to it on a per-port basis (still not advisable, in my opinion) through a firewall? – Bart Silverstrim Mar 18 '10 at 14:34
Yes. Laziness comes to my mind - saving the money for a NAT router. – TomTom Mar 18 '10 at 14:41
@Bart true, that is a slightly better option than adding the IP to the servers interface, if you have to give external access to your DC. Unfortunately i've seen alot of small business who have their server setup directly with a public IP (often by someone who setup their IT along time ago, never to be seen since), and won't pay out for a Decent hardware firewall, or even a NAT router. – Sam Mar 18 '10 at 15:00

What Sam and Squillman said. If the setup is sane, it is possible that the DC is also running your public DNS in which case you want just those services opened up on the firewall. I would still keep the entire thing not exposed though and just set up a second bind server or something myself.

Also, the server itself having a public IP seems odd, normally it would have a private IP and would be NAT'd to I think.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.