0

Let's say I have an internal LAN (LANA) with AD/DHCP/DNS, isolated from the internet with no default gateway. Its DNS Server DNSA is thus non-recusive. A few of the servers also have a second NIC to a seperate LAN/Subnet (LANB) which does have a default gateway router/firewall to the internet. Accordingly they also have a set of public recursive DNS resolvers (DNSB) configured.

Network Map http://christoph.ruegg.name/storage/img/dualdnsnetwork.png

For a while the servers with two NICs have been able to resolve using both nameservers in some way (or it was simply working by accident thanks to caches). But now they seem to be using only DNSA for resolving names, without retrying on DNSB after (obviously) failing to resolve any internet domains - so they can't resolve internet domains anymore.

It doesn't seem Windows Server DNS can forward to an external DNS server it doesn't have access to (i.e. without enabling recursive resolving)

Can this network layout work reliably at all, or do I have to attach DNSA to LANB as well and turn it into a recursive resolver? Or is there another way, e.g. using conditional forwarders? (I'd prefer to completely isolate some servers, although of course I'm aware that doesn't help if one of the dual-NIC servers is hacked)

Improve this question
2
  • In addition to my answer (which might be completely off base) have you configured NICA to use only DNSA and NICB to use only DNSB?
    – joeqwerty
    Jul 27, 2010 at 11:54
  • Yes, exactly, that's how it was configured before.
    – Christoph Rüegg
    Jul 27, 2010 at 19:40

1 Answer 1

Reset to default
1

I have a similar setup with my TS servers, each has two NIC cards, one connected to the internet with a DG (configured to not register in DNS) and one connected to the LAN without a DG (configured to register in DNS). The problem is that both NIC's use the same set of recursive DNS servers for internal and external DNS so I can't tell you exactly how it would work if the internal and external NIC cards used different DNS servers.

I've never done this with an AD domain but here's what I would try:

  1. Remove DNSA from the TCP\IP configuration of the dual NIC servers so that they only use DNSB for DNS resolution.

  2. Set up DNSB to use DNSA as a conditional forwarder for the AD DNS Domain that DNSA hosts.

That will allow the dual NIC servers to have external name resolution via DNSB and internal name resolution via DNSA, as DNSB will forward any requests for DNSA's zone to DNSA for resolution.

The thing to look out for would be that the dual NIC servers can still communicate, authenticate, resolve, and register with the AD domain using DNSA via DNSB.

If you do it the other way by configuring DNSA to use DNSB as a conditional forwarder for all other domains (all except the AD DNS domain) then that will have the affect of allowing all clients on LANA to have external DNS resolution via DNSB as a conditional forwarder, which you may not want.

Improve this answer
2
  • Thanks very much. I don't have control over DNSB, so I've added a new DNS server (DNSC) instead, connected to both LANA and LANB. DNSC has DNSB as forwarder and DNSA as conditional forwarder for the domain. Works nicely, DNSC now recursively resolves both internal and external domains correctly. (DNSA is managed automatically by DHCP in my setup.)
    – Christoph Rüegg
    Jul 27, 2010 at 19:39
  • Glad it worked.
    – joeqwerty
    Jul 27, 2010 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .