I have an active directory and some servers running on public IPs Like

ADS --> 62.xx.xx.210

Server joined ADS 

Team foundation server --> 62.xx.xx.211

SQL Server --> 62.xx.xx.212

Exchange server --> 62.xx.xx.213

Web Server --> 62.xx.xx.214

Web Server --> 62.xx.xx.215

And some other servers / windows 8.1 

My Active directory is currently under DNS amplification attack and server provider has advised to take action or services will be stopped by them. I tried to work on UDP port 389, but as soon as I block the port 389 exchange server stops working. My main aim is to deal with DNS amplification attack, and I read and realized that I have done wrong in start by creating a public active directory. Now I am working on moving active directory from Public IP to a Private IP. To achieve this, I added new interface in each server created a private network among all and each machine can ping other on private IP as well. (Added routes) Now I Have

ADS --> 62.xx.xx.210,

Server joined on Public IP and have Private IPs

Team foundation server --> 62.xx.xx.211,

SQL Server --> 62.xx.xx.212,

Exchange server --> 62.xx.xx.213,

Web Server --> 62.xx.xx.214,

Web Server --> 62.xx.xx.215,

Now How can I make it work that I move all servers to join private domain and also available on public IPs as well. But active directory remains private only. Means, I disable the public interface of active directory or change the DNS to listen only on private interface, but all other servers, available on public IPs but authenticate from Private ADS. Any advice, what should be done.

Thank you

  • 3
    Hi, this is a broad question, not sure if better answered by a consultant that would see your setup, than there on the internet – yagmoth555 Nov 24 '18 at 14:02
  • 2
    The problem isn't that you used a public IP address, it's that you exposed your network to the Internet. Holster the footgun and read up on firewalls. – Greg Askew Nov 24 '18 at 14:50
  • 1
    Use a firewall, don't allow recursive DNS queriess from just anyone, and PLEASE hire a consultant who can fix things for you. You're in way over your head here. – Tommiie Nov 25 '18 at 7:39

The following does not answer the question "how to change to private IPs". This probably can't be answered in a Q&A forum. But you may take short time actions to keep your business running:

Addtional external IP

  • Get an addional, new external IP from your ISP
  • separate your 62.xx.xx.xx network from the physical internet network
  • install a firewall with NAT (like pfsense) for the internet access

If you can't get an additional external IP

Your network 62.xx.xx.xx seems seems to be big. (/26?). May be you can split it up into two smaller subnets. In the first subnet you keep your internal servers and a gateway IP and seperate it from the physical internet network. From the second subnet you chosse an IP as external IP and install a NAT firewall as mentioned above.

As a long term strategy you need to think about firewalls and DMZ's.

Hope it helps, good luck!

| improve this answer | |
  • I understand that i can put pfsense in front and do some port forwarding. and in i have sorted the issue out by using firewall. but i think that is not a proper solution, and I am still looking for a solution, that i add an other IP/NIC and change active directory to new IP and change all joined domains to new IP. but after changing the IP, new machines are not joining the domain. – Ali Nov 27 '18 at 8:49
  • @Ali Then you most likely have an DNS issue. Does your DNS serve is available and resolves properly? – marsh-wiggle Nov 27 '18 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.