I have a Server 2008 R2 Enterprise server with 4 NICs. 2 are teamed for LAN 2 are teamed for WAN. This server has the Active Directory Domain Services, DNS and RRAS roles installed.

It seems that Windows is detecting the public (WAN) connection is a Domain Connection.

Is there anyway to change this to be a public connection and not domain?

  • 1
    Microsoft strongly recommends against using multihomed hosts for domain controllers for a variety of reasons. I'm not familiar with the specific problem you're seeing, but I'm not surprised that it's problematic either. – Evan Anderson Jul 29 '10 at 17:04
  • 1
    It is not mis-identifying. It finds a doain controller there = domain connection. – TomTom Jul 29 '10 at 17:54

A DC shouldn't be multihomed (= placed on two different networks at the same time), because this could mess up quite some things unless you can deal properly with DNS registrations and some other settings; and, even in this case, it could mess up some things anyway.

That said, placing it on a public network looks even a worse choice than simply multihoming it...

What is the specific reason for this setup?

About your problem: I don't think there's a way to solve that, other than manually configuring Windows Firewall to block everything you don't need on the public side and allow everything you need on the private side; Windows really doesn't have any way to read your mind and say "hey, this is my private network and this is a public one I shouldn't trust": it's a domain controller, obviously any network connections it could have has to be a domain one. After all, you could very well be creating a domain on a set of public IP addresses, couldn't you?

  • There's no specific reason per-se other than the limitation on Hardware. What would be the recommended setup without having to add more hardware? – Chad Moran Jul 29 '10 at 20:03
  • What's the reason for connecting it to both networks? Will it act as a firewall? Does it need to host publicly-available services, like IIS web sites? Does it only need an Internet connection? In any case, a separate firewall box (be it an appliance or an actual firewall server) would be a lot better solution. – Massimo Jul 29 '10 at 20:11
  • It acts as a VPN server. – Chad Moran Jul 29 '10 at 20:34
  • 1. Kill the teams, I've seen teaming do more harm then good. 2. You can configure the server to provide web, ftp, VPN, etc., etc. with a single NIC. You might also consider configuring your firewall\router as a VPN server instead of the Windows server. – joeqwerty Jul 29 '10 at 23:31
  • You should really put another firewall in place (even an old Linux box, if you can't get a proper one). Then you can have it provide VPN services, or just forward the proper port(s) to your server. This will solve the multihoming issue, and also it will be a lot more secure. You don't want someone breaking into your domain controller. You really don't want it. – Massimo Jul 30 '10 at 7:52

Is the WAN team configured to use the LAN team's ip address for DNS resolution and is the WAN team configured to register with the internal DNS? If so then my bet is that's the problem.

  • That was in fact how it was setup. I tried setting the WAN team's DNS to external DNS servers and it seems it's still identifying it as a Domain Connection. – Chad Moran Jul 30 '10 at 16:38
  • @Chad: don't do that. That's exactly what you need to avoid when multihoming a domain controller. A domain controller, like any other domain computer, should use only domain DNSs (itself, in this case). – Massimo Jul 30 '10 at 18:15
  • @Chad: to clarify: in your situation, if you really need to multihome that DC, it whould use itself as a DNS server in its intrnal network interface, and no DNS at all on the external one; also, on that interface, you'll need to disable automatica DNS registration (and also Windows networking protocols and NetBIOS, to be on the safe side). – Massimo Jul 31 '10 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.