Server 2012 DNS with multi lan pfsense - noob help
-
Hi,
I am a complete noob where DNS is concerned. I am implementing a server 2012 domain on one of several lans behind a PFSense firewall. My understanding is that it is best to let the AD handle the DHCP & DNS for that lan but I would like to be able to attach to the domain computers from other lans what is the best way to enable the name resolution idealy with detailed instructions please. -
As to dns just allow the dns traffic from network segment 1 to network segment where your AD dns server is..
As for dhcp, just setup pfsense for dhcp relay pointing to your dhcp server on the networks that are not the same as where your dhcp server is.
Keep in mind your going to need more ports open for clients to your DC then just dns to join the domain. Going to be quite a few ports required between the client and the dc, keep in mind rpc through firewall can be difficult, since many ports can be used – you can limit the ones used.. Here is where I would get started
https://technet.microsoft.com/en-us/library/dd772723%28WS.10%29.aspx
Active Directory and Active Directory Domain Services Port Requirements -
Thanks johnpoz, I've just posted a similar thread with regards to doing this over a VPN. All traffic is allowed to freely move across the tunnel both ways with no restrictions, but the different subnets I'm finding it hard to get my head around. Surely using a dhcp relay to the DC, wouldn't that result in the client getting an IP on the wrong subnet?
In my case I'd like some form of fault tolerance as well really in case the tunnel or DC goes down for some reason it would be nice for clients at each site to still have internet access so I'm not really sure how best to set that up.
-
I would suggest you read up on dhcp if you don't understand how dhcp relay works.. No it wouldn't get an IP off the wrong scope..
Since you seem to me a windows guy, here this should help you understand how a relay works
https://technet.microsoft.com/en-us/library/cc779610%28v=ws.10%29.aspx
Understanding relay agentsSo your wanting to use dhcp relay across a vpn connection?? And then these clients will be talking to your dc at your site through a vpn connection as well? How stable is this vpn connection? You prob want to put a DC at your other site..
If your tunnel goes down which is a reason you would want to run dc at the other site.. If you the tunnel goes down, you would still have internet? Or is the tunnel over the internet? As to local dns when dns goes down on the dc.. This would be why you would run more than one AD name server.. To be honest if the dc goes down, don't you have bigger problems than user able to get to youtube?
What if pfsense goes down? Now you don't have internet, nor site to site, etc.
Yes if your wanting to setup redundancy in your network, you need to look at all the failure points and hit the critical ones first to be honest.. Your AD being down would seem to be a major issue, having another DC also running dns and allowing for auth would be normal setup yes.. This could provide you with failover for dhcp as well, etc.
Do you have redundant switches ? Internet connections? etc. etc.. Do your devices have dual power supplies? etc. etc..
-
Thanks johnpoz, the main DC is at their headquarters but that's in a remote location with both very slow and unreliable internet, and frequent power cuts. I've got another DC in a datacenter joined by a site to site link, the branch offices will then be connected via that DC, branch offices are in well-connected areas (London and Reading) with reliable and 'fast enough' connections but those portions are on the pfSense DHCP/DNS side of things. File shares are also currently replicated to the datacenter so branch offices will be able to access those now. I'll look at the relay documentation that you've referenced though and have a crack at that. I'm not too experienced with VPNs at this stage so trying to learn as much as I can before I get it all setup. If all goes to plan I'll relocate their main DC/Exchange server (running SBS 2008) to the datacenter and the secondary DC to the headquarters so the branch offices will have more reliable access to Exchange. It's for a charitable organisation who are limited on funds so I'm currently covering the datacenter charges on their behalf so might as well make the most of it and do it right. They've been running a single SBS server for a few years now at headquarters, and the branch offices only had Exchange access via the web interface, I'm hoping that properly implementing a VPN solution will eventually get all branch offices communicating more effectively and reliably.
-
I would make sure the remote locations are setup correctly in sites and services as well for the DCs there.. You can leverage the DataCenter DC if the DC in the site fails, etc.
This might help
http://blogs.technet.com/b/canitpro/archive/2015/03/04/step-by-step-setting-up-active-directory-sites-subnets-amp-site-links.aspx
Step-By-Step: Setting Up Active Directory Sites, Subnets & Site-Links
