Running a Windows domain from a non-windows DNS

Question

Is that even possible?

I would like to have pfsense triple up as DNS + DHCP + Firewall/router for my windows domain. The question is, is that even possible? I'm a developer not a sys admin so please keep that in mind when you post.

Failing that, how the heck do I have my local DNS forward to external resolvers?

Many thanks

Answer 1

You'll have a better time of it running DNS on your domain controller computer w/ the Microsoft DNS server. It's technically possible not to use Microsoft DNS (see http://serverfault.com/questions/32605/using-bind9-and-dhcpd-to-support-a-windows-domain for some details) but it's a bit of a pain. In general, you'll have an easier-to-manage configuration if you just use Microsoft's DNS server for, at the very least, the Active Directory domain.

You can use the Microsoft DNS server for all your recursive resolution needs, as well. The Microsoft DNS server is configured to use root hints by default, so you don't need to worry about using forwarders if you're looking for recursive resolution of Internet domain names. If you really want to use forwarders you can do that, as well, by configuring either blanket or conditional (per domain) forwarding in the settings for the Microsoft DNS server (via the DNS Management management console snap-in).

You don't mention your version of Windows Server, but it's configured much the same way between Windows Server 2003 and 2008-- see http://technet.microsoft.com/en-us/library/cc773370(WS.10).aspx for details.

Answer 2

The DNS part will give you problems - Active Directory uses DNS records for all its service-location information, with said extra records being regularly updated/changed/removed by the servers. Trying to replicate all of this on a non-domain-integrated DNS server will, I suspect, lead to pain.

Adding another DNS server for plain (non-AD) DNS resolution is certainly doable (see Evan's answer for more), but since your DC needs to be a DNS server anyway, you're as well sticking with that and sending all the non-local requests to an external resolver, as you suggested. These are listed (and added) in the "Forwarders" section of the DNS server's properties in the DNS Manager (assuming you're on some version of Windows server).

There's no reason that you can't press your pfsense box into service as a router and DHCP server as well, though.