Internet DNS vs. Intranet DNS

I've made couple of posts and read a $....load of posts about this issue but I still need help w/ one thing. This office where I'm setting up the network uses set-up like this

bussines class DSL ---> HD firewall (watchguard firebox SOHO6)---> switch--->

there are buncha clients connected to the switch and more importantly one DNS/Domain Controller

the external network @ the firebox is a registered IP w/ 255.255.255.240 mask and 2 static Internet DNS's.

the trusted network is 192.168.111.1 which is the firebox w/ 255.255.255.0 mask....
then you have the switch
the server has 192.168.111.2 static IP and the firebox is configured to accept 192.168.111.2 as a static route
then the firebox is configured to DHCP from 192.168.111.3 and all the clients recieve the dynamic IP...

i don't think i needed to set up the server as a DHCP server since the firebox is already doing it, but none of the clients see the domain.

all the clients can get onto the Internet fine w/ their dynamic IP's but they don't see the 192.168.111.2 domain. you can ping it from the clients but you can't connect to it. how can i set up the firebox/server/client so the clients check the DNS on the server first before going to Internet DNS's

All your client have dynamic IP provide by DCHP server who your firewall except the Server who have a static IP. This is what I understand so here my info

1) Internet DNS vs. Intranet DNS are very apart stuff. Don't mess them together.

2) Does your server can surf the Internet. Did you force the Internet DNS server in the Tcp/Ip protocol?

3) Can your other client ping your server?

4) Did you install and CONFIGURE Windows 2000/2003 DNS before setting an Active Directory?

1. i know...
2. yes ... all the clients and the server can go on the internet... yes all the clients can ping the server (192.168.111.2 static address)
all the clients are configured to dynamic address and they can acces the net
the server is the only one which is configured to static IP 192.168.111.2 (192.168.111.1 is the firebox)
3. when you configure the Active Directory the setup will ask you about the DNS and automatically configure the DNS for you. I did that!!!

At this point I don't know how come client CAN resolve any web sites but CANNOT see the MS domain.

I did configure the domain as the FIRST domain tree in the FIRST domain forest ... should i make it a subdomain or somehow reley the info to the clients...

can anyone help me... i will accually send you money throught paypal... just pls help me figure this out

Rabit,
What message do you get when you try to connect to the domain. Also is it when you try to add a machine to the domain you get the error or when you try to use a resource on the domain?
If your machine can ping the domain it should be able to connect to it.

It sounds like your clients might be getting their DNS from the Firewall, (they DHCP it and if you put a DNS server entry into the firewall then it may be providing that to the clients too). If this is the case then they are asking resources outside your domain for information about the inside which they do not have hence you can't see your domain.

Try this: Go to a client, open a command prompt and type nslookup <Enter>. This will take you to the default DNS server for that client. If it is outside your network go to network settings and tell the cliennt not to get it's DNS server from the DHCP server but to use your internal server. Then re-run nslookup and see what the server is. Once you are looking internally then make sure you have your domain set up in the DNS, (is this a Win2k server?). If it is Win2k have DNS set up the zone for you by making it an AD integrated zone and all the appropriate records for domain management will be created for you.

In the server's network settings tell it that it's secondary DNS server is the one outside, (your ISP's), DNS. That way when it is asked for DNS resolution of a domain outside yours for a client it can go to the internet to get the information.

DO NOT, allow remote machines access to your internal DNS server or they can determine the entire layout of your network.......

To follow Tigershark idea, it could be more easy is to set your server as DCHP server and stop using your Firewall as DCHP.

I configured the firbox to give out the DNS as 192.168.111.2 w/ the DHCP so I don't understand what the hell

Does "DHCP relay" have anything to do w/ it

I also tried to configure the clients to go to static DNS 192.168.111.2 and all this accomplished was that they couldn't go to the Internet.

I think now that I may have configured the DNS server wrong. But I have only followed the instructions. Made it the only server 1st tree 1st forest. Should I configure the DNS first and then "dcpromo" it later or can i just Do the wizard for AD which configures the DNS for you.

I, too, was wondering about configuration of an intranet DNS server.

Anyone have a mess of good tutorials for setting up a Linux based DNS server for my LAN at home?

1. Uninstall your DNS on the server.
2. Run DCPROMO
3. Tell it to install an AD integrated zone.

Now you have an AD Domain.

1. Remove the ability to provide DHCP from the firebox, remove any reference to DNS servers from the firebox.
2. Install DHCP on the AD server.
3. Set up a scope appropriate to your network
4. Set up the scope options appropriate for your network including DNS pointing to the AD server.
5. Open DNS on the server and allow it to make recursive queries, (I believe that's it).
6. Ensure that your firewall allows outbound DNS on both TCP and UDP from your server only.
7. Ensure all DNS inbound is blocked at the firewall.
8. Reboot a client.
9. Join it to the domain
10. The internet should now work and so should the domain.

If not see if you can tell me where a step went wrong.

how exactly should i uninstall DNS ... you mean from the Add/Remove Programs Menu

remove the whole service???

I go with tigershark... I think your clinets are assigned external DNS ip along with the dynamic IP..... you should put the internal DNS servers IP address on DHCP server's configuration and on the DNS server ( open DNS snapin from admin tools) under properties ( of the server not that of forward zone) theres a forwarders tab..... plug in your external DNS address in there.......

This should work......good luck

in a firebox soho under "trusted" you can set the dns settings to a local server which then gets and caches forign dns requests from a statically assigned exterior dns server while the "exterior" FW setting picks up its settings from verizon or who ever. No pass threw. i use sohos for vpn clients and set up the main dns servers at hq for the trusted settings

I go with TigerShark also! Good Answer Man!

the problem here is that when I accually do dcpromo the domain doesn't work. i need the clients to see it but they can't ... they can ping to the server but that's it

rabit- I think you need to go read a lot about how DNS and AD integrate together. It will be very hard for anybody here to walk you through configuring your network via text if you don't understand the basics.

If you point all of your clients to your internal DNS, the clients should be able to resolve the domain, if you have installed AD properly(which is easy to do). When you have your internal clients pointed at your internal DNS, and they cannot resolve items on the internet, the reason for this is that you are not passing external DNS requests from your internal DNS server to the external DNS server. It is pretty easy to configure, once you understand how DNS works.

Rabit, you are positive that all your clients are pointing to the DNS server's IP address? I just went through the same issue recently (none of my clients were seeing the domain) and my problem was that I had to set the Primary DNS server to point to the DNS server's IP on each client along with allowing dynamic updates in my Foward Lookup Zone. (This is for Win2K, I don't know if Win2003 is any different)

I used these two references from a M$ article to fix my problem.
Ref 1:
1. Right-click My Network Places, and then click Properties.
2. Right-click Local Area Connection, and then click Properties.
3. Click Internet Protocol (TCP/IP), and then click Properties.
4. Click Advanced, and then click the DNS tab. Configure the DNS information as follows:
1. Configure the DNS server addresses to point to the DNS server. This should be the computer's own IP address if it is the first server or if no dedicated DNS server will be configured.
2. If the resolution of unqualified names setting is set to Append these DNS suffixes (in order), the Active Directory DNS domain name should be listed first (at the top of the list).
3. Verify that the DNS Suffix for this connection setting is the same as the Active Directory domain name.
4. Verify that the Register this connection's addresses in DNS check box is selected.
5. At a command prompt, type ipconfig /flushdns to purge the DNS resolver cache, and then type ipconfig /registerdns to register the DNS resource records.

I also had to Allow Dynamic Updates in my Foward Lookup Zone
Ref 2:
Use the following steps to ensure that DNS is registering the Active Directory DNS records:
1. Start the DNS Management console.
2. Expand the zone information under the server name.
3. Expand Forward Lookup Zones, right-click the name of the Active Directory domain's DNS zone, click Properties, and then verify that Allow Dynamic Updates is set to Yes.
4. Four folders with the following names are present when DNS is correctly registering the Active Directory DNS records. These folders are labeled:

_msdcs
_sites
_tcp
_udp

If these folders do not exist, DNS is not registering the Active Directory DNS records. These records are critical to Active Directory functionality and must appear within the DNS zone. You should repair the Active Directory DNS record registration

Full Article Here

I hope this can help you as it did me. good luck.