Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is that even possible?

I would like to have pfsense triple up as DNS + DHCP + Firewall/router for my windows domain. The question is, is that even possible? I'm a developer not a sys admin so please keep that in mind when you post.

Failing that, how the heck do I have my local DNS forward to external resolvers?

Many thanks

share|improve this question

You'll have a better time of it running DNS on your domain controller computer w/ the Microsoft DNS server. It's technically possible not to use Microsoft DNS (see for some details) but it's a bit of a pain. In general, you'll have an easier-to-manage configuration if you just use Microsoft's DNS server for, at the very least, the Active Directory domain.

You can use the Microsoft DNS server for all your recursive resolution needs, as well. The Microsoft DNS server is configured to use root hints by default, so you don't need to worry about using forwarders if you're looking for recursive resolution of Internet domain names. If you really want to use forwarders you can do that, as well, by configuring either blanket or conditional (per domain) forwarding in the settings for the Microsoft DNS server (via the DNS Management management console snap-in).

You don't mention your version of Windows Server, but it's configured much the same way between Windows Server 2003 and 2008-- see for details.

share|improve this answer

The DNS part will give you problems - Active Directory uses DNS records for all its service-location information, with said extra records being regularly updated/changed/removed by the servers. Trying to replicate all of this on a non-domain-integrated DNS server will, I suspect, lead to pain.

Adding another DNS server for plain (non-AD) DNS resolution is certainly doable (see Evan's answer for more), but since your DC needs to be a DNS server anyway, you're as well sticking with that and sending all the non-local requests to an external resolver, as you suggested. These are listed (and added) in the "Forwarders" section of the DNS server's properties in the DNS Manager (assuming you're on some version of Windows server).

There's no reason that you can't press your pfsense box into service as a router and DHCP server as well, though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.