Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup a server at work and I want to use 2 network cards to have a local and external (internet) interface. I have set it up as follows:

Internal Network Setup

External Network Setup

This server will be used for Windows Deployment Services and I would like to spoof internet domains and redirect them to this server. This would be for antivirus updates as they can be very slow sometimes so having them locally will help. Also Windows Server Update Services will be used.

I have setup NAT on the server but when a machine gets an IP address through DHCP, the machine has no internet access...

share|improve this question
Sounds like you've got a server, acting as a router (w/ NAT); and you want it to support WDS, WSUS, and you're going to setup DNS to point certain domains to it as well. But you're using internal IPs on both adapters, and from the same subnet. Is that much correct? – Chris S Mar 18 '11 at 18:42
Which adapter is which? I always rename mine to "internal"/"external" to keep them clearly documented. – Bret Fisher Mar 18 '11 at 18:52
Yes that's right Chris. Is this where the problem is? Do I need to have the server on IP and, let's say, other machines on I have renamed them slightly, as you can see at the top of the properties box. Are these the right settings? – Dean Perry Mar 18 '11 at 18:54
Also Chris, we have a linksys router which will be connected to the server (on the external connection) and a gigabit switch which will have machines running off it (the internal connection) – Dean Perry Mar 18 '11 at 18:58
are you expecting these computers to be plugged into a "private" switch behind this server, get windows and updates, and then you'll move them to the "production network"? – Bret Fisher Mar 18 '11 at 19:01

Wouldn't it be best to have the external and internal on different subnets?


Int. IP:

share|improve this answer
What would be the advantages of this? – Dean Perry Mar 18 '11 at 19:07
yea if you're going to have two switches segmenting the two networks deanpcman then you should use a different subnet on the internal. Technically you don't need NAT since both addresses are private (your Internet firewall is already doing NAT), but no harm if it's just for deployments. Change your DHCP to point to the new internal address. Also, the server shouldn't need to point to itself for DNS, but rather your standard network DNS... only the deployment clients need the "special" DNS IP. – Bret Fisher Mar 18 '11 at 19:08
OK thank's Bret! Will give it another go when I get back in the office tomorrow and let you know how I get on :) – Dean Perry Mar 18 '11 at 19:11
deanpcmad, you can't route on inside a single subnet. if you want the clients to route through the server for all traffic, they need to have the internal IP of the server be on a different subnet then the IP's on the outside of the server. Make one up that's not in use like 192.168.x.1-254 and same subnet mask of – Bret Fisher Mar 18 '11 at 19:12
Ahh OK, that must have been the problem. I will give it a go tomorrow and let you know... – Dean Perry Mar 18 '11 at 19:48

with that server pointing to itself for DNS, can it browse web sites? If no then your DNS server may not have port 53 out TCP/UDP for querying DNS roots. If yes, then can a client pointing to the server for DNS do nslookup on If it can't resolve then server firewall may be preventing connections. Use Microsoft Network Monitor on server to look for incoming connections on 53 and see if clients are successfully connecting.

share|improve this answer
Yes it can browse sites. I'm connected to it over the internet using Remote Desktop – Dean Perry Mar 18 '11 at 19:00

It may be easier for you to use ICS:

share|improve this answer
OK, will check it out =] – Dean Perry Mar 18 '11 at 19:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.