Win2k3 as primary DNS with pfsense dns forwarder
-
our network is a mix environment consisting of windoze 2003, Linux and FreeBSD and windoze xp/2k0/98 as clients, currently i have installed active directory in our windoze 2k3 DC and it also serves as DNS server, my question is which will best suit our network, the win2k3 as primary DNS and pfsense serving as secondary DNS and dhcp? or having just the win2k3 DNS and not using the DNS forwarder of pfsense?
in the dns forwarding page, what will happen if i put an override for our domain example.org and list the win2k DNS as the authoritative DNS?TIA
-
I suggest using the Windows as primary DNS as it also is the primary domaincontroller. You can assign the pfSense as secondary as fallback. I even would rather use DHCP at the pdc in that scenario but having the pfSense handle DHCP should be fine too. The override for domain just forwards the requests for that Domain to a special DNS-Server but for the clients the resolution will still be done by the pfSense.
-
I would suggest a slightly different approach. Let the Windows Server handle primary DNS and DHCP on its own. Why so? Because of the AD integration. External DHCP Servers do not know you have an AD Server and therefore aren't able to e.g. dynamically update the DNS zonefile for your internal domain as an ADS integrated DHCP server is able to. But that depends on your scenario and aims.
I have a customer with a similar environment and he uses the pfSense box as DNS forwarder in the DNS config of w2k3 and as sec. DNS in the client config.
-
I actually suggested that too ;)
I even would rather use DHCP at the pdc in that scenario but having the pfSense handle DHCP should be fine too.
-
if i use win2k3 as the primary dns and dhcp serverand pfsense as secondary, what settings in pfsense do i have to change/enable/disable? currently dns forwarding and Register DHCP leases in DNS forwarder are enabled.
TIA
-
You have to disable the dhcp server at pfsense or you will run into issues because of having 2 dhcp servers in your network (maybe conflicts or clients hopping between IPs and so on). That's all.
-
I actually suggested that too
Eek, that slipped through ;) Two heads - same thought :)
