1

I have a Server 2008 R2 Enterprise server with 4 NICs. 2 are teamed for LAN 2 are teamed for WAN. This server has the Active Directory Domain Services, DNS and RRAS roles installed.

It seems that Windows is detecting the public (WAN) connection is a Domain Connection.

Is there anyway to change this to be a public connection and not domain?

2
  • 1
    Microsoft strongly recommends against using multihomed hosts for domain controllers for a variety of reasons. I'm not familiar with the specific problem you're seeing, but I'm not surprised that it's problematic either. Jul 29, 2010 at 17:04
  • 1
    It is not mis-identifying. It finds a doain controller there = domain connection.
    – TomTom
    Jul 29, 2010 at 17:54

2 Answers 2

1

A DC shouldn't be multihomed (= placed on two different networks at the same time), because this could mess up quite some things unless you can deal properly with DNS registrations and some other settings; and, even in this case, it could mess up some things anyway.

That said, placing it on a public network looks even a worse choice than simply multihoming it...

What is the specific reason for this setup?

About your problem: I don't think there's a way to solve that, other than manually configuring Windows Firewall to block everything you don't need on the public side and allow everything you need on the private side; Windows really doesn't have any way to read your mind and say "hey, this is my private network and this is a public one I shouldn't trust": it's a domain controller, obviously any network connections it could have has to be a domain one. After all, you could very well be creating a domain on a set of public IP addresses, couldn't you?

7
  • There's no specific reason per-se other than the limitation on Hardware. What would be the recommended setup without having to add more hardware?
    – Chad Moran
    Jul 29, 2010 at 20:03
  • What's the reason for connecting it to both networks? Will it act as a firewall? Does it need to host publicly-available services, like IIS web sites? Does it only need an Internet connection? In any case, a separate firewall box (be it an appliance or an actual firewall server) would be a lot better solution.
    – Massimo
    Jul 29, 2010 at 20:11
  • It acts as a VPN server.
    – Chad Moran
    Jul 29, 2010 at 20:34
  • 1. Kill the teams, I've seen teaming do more harm then good. 2. You can configure the server to provide web, ftp, VPN, etc., etc. with a single NIC. You might also consider configuring your firewall\router as a VPN server instead of the Windows server.
    – joeqwerty
    Jul 29, 2010 at 23:31
  • You should really put another firewall in place (even an old Linux box, if you can't get a proper one). Then you can have it provide VPN services, or just forward the proper port(s) to your server. This will solve the multihoming issue, and also it will be a lot more secure. You don't want someone breaking into your domain controller. You really don't want it.
    – Massimo
    Jul 30, 2010 at 7:52
1

Is the WAN team configured to use the LAN team's ip address for DNS resolution and is the WAN team configured to register with the internal DNS? If so then my bet is that's the problem.

3
  • That was in fact how it was setup. I tried setting the WAN team's DNS to external DNS servers and it seems it's still identifying it as a Domain Connection.
    – Chad Moran
    Jul 30, 2010 at 16:38
  • @Chad: don't do that. That's exactly what you need to avoid when multihoming a domain controller. A domain controller, like any other domain computer, should use only domain DNSs (itself, in this case).
    – Massimo
    Jul 30, 2010 at 18:15
  • @Chad: to clarify: in your situation, if you really need to multihome that DC, it whould use itself as a DNS server in its intrnal network interface, and no DNS at all on the external one; also, on that interface, you'll need to disable automatica DNS registration (and also Windows networking protocols and NetBIOS, to be on the safe side).
    – Massimo
    Jul 31, 2010 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .