I'm bringing a new Windows 2012 R2 Domain Controller online. Its very well documented that a DC should NOT have multiple network interfaces. My DC will also host DNS. I'd like to configure forwarders on the DNS server but without an external network interface this would never work. The enabled Internal network interface is on a private network and does not have internet access. Am I missing something?

The DC has two physical network interfaces (typically named External and Internal) and I've disabled the External interface based on best practices. The External interface would be used for forwarding DNS requests.

Any help would be greatly appreciated.

  • 1
    Why do you have it configured with two interfaces? It only needs one. You only need to allow outbound DNS from the DC to the internet. It sounds like you may be making this more complicated than it is. – joeqwerty Oct 4 '16 at 18:55
  • @joeyqwerty, the DC needs an internal interface on a private network to services it's clients (shared file access, domain authentication, etc...). I can't configure a single network interface on both a private and public network? – user379091 Oct 4 '16 at 19:28
  • 1
    I can't configure a single network interface on both a private and public network - Does your network not have NAT, and a stateful firewall? 'Private' networks can typically make outbound connections through the firewall which will perform address translations and prevent unsolicited incoming requests. – Zoredache Oct 4 '16 at 19:42
  • @user379091: The usual and standard way of doing this is to use a single network interface on the private network and to use a network firewall to allow outbound access to the internet from the private network. – joeqwerty Oct 4 '16 at 19:54
  • We leverage an IaaS provider and all of our infrastructure runs on VMs so I don't have a traditional physical firewall where I can NAT outbound requests. – user379091 Oct 4 '16 at 20:03

does not have internet access. Am I missing something?

Yup, most people don't lock down their DCs to not have outbound access to the Internet. They are typically set to be able to make outgoing requests just like all the other computers on your network.

If you really think you need to do this for security reasons in your environment, then you are going to need to setup some kind of recursive DNS server in a DMZ or something that can resolve things on the internet, then set your DNS server on your DC to forward to that server.


On a Server 2012R2 DNS computer forwarders should not be necessary, if you can access the internet from this server. When you install DNS the root hints will be populated which takes the place of forwarders. Most vm infrastructures are configured with routing enabled. Spin up a test vm and try it without forwarders.

  • To clarify, root hints don't take the place of, or replace forwarders. Both can be used alone or together. One doesn't take the place of or replace the other. The use of either or both is optional, so it's not a matter of one or the other being necessary or unnecessary. – joeqwerty Oct 4 '16 at 23:29

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.