I have an active directory and some servers running on public IPs Like
ADS --> 62.xx.xx.210
Server joined ADS Team foundation server --> 62.xx.xx.211 SQL Server --> 62.xx.xx.212 Exchange server --> 62.xx.xx.213 Web Server --> 62.xx.xx.214 Web Server --> 62.xx.xx.215 And some other servers / windows 8.1
My Active directory is currently under DNS amplification attack and server provider has advised to take action or services will be stopped by them. I tried to work on UDP port 389, but as soon as I block the port 389 exchange server stops working. My main aim is to deal with DNS amplification attack, and I read and realized that I have done wrong in start by creating a public active directory. Now I am working on moving active directory from Public IP to a Private IP. To achieve this, I added new interface in each server created a private network among all and each machine can ping other on private IP as well. (Added routes) Now I Have
ADS --> 62.xx.xx.210, 10.28.62.210
Server joined on Public IP and have Private IPs Team foundation server --> 62.xx.xx.211, 10.28.62.211 SQL Server --> 62.xx.xx.212, 10.28.62.212 Exchange server --> 62.xx.xx.213, 10.28.62.212 Web Server --> 62.xx.xx.214, 10.28.62.214 Web Server --> 62.xx.xx.215, 10.28.62.215
Now How can I make it work that I move all servers to join private domain and also available on public IPs as well. But active directory remains private only. Means, I disable the public interface of active directory or change the DNS to listen only on private interface, but all other servers, available on public IPs but authenticate from Private ADS. Any advice, what should be done.