Yes I do have a router, and firewall. My dns server is in my dmz network, and it is assigned one of my private ip’s.

0

Exactly. So, does your ISP provide static IP to you, or dynamic. If dynamic, you must get DDNS service as well. "Milk was a bad choice!"

0

ISP provides static, hence private IP for my DNS server.

0

"ISP provides static, hence private IP for my DNS server." That makes no sense. Private IP = IP address within commonly accepted ranges by convention for use with networks not connected to the internet originally, although the inception of NAT now allows routing from them to and from the internet. 192.168.0.1 is an example of a private class C IP address. Static IP means the address is configured manually on a node. ANY IP address, public or private, can be statically configured on a server. Dynamic IP means your IP is obtained by a DHCP server. ANY IP address, public or private, can be obtained dynamically. If your DNS server has a private IP, you must be using NAT to share whatever public IP addy you have. But all that is irrelevant to this question of whether your WAN IP is static or dynamic. What router do you have? Is this a SOHO router like a Linksys, Dlink, Netgear...? Or is this a Cisco router? "Milk was a bad choice!"

0

heropsycho2177, My WAN IP is static. I understand the basics, and understand most of the stuff you said, but I don’t always communicate everything correctly, sorry. (I always get private and public mixed up). More detailed information on what I have. I have a SOHO router, which is a Sonicwall Pro 2040, and it has two options for DMZ. The sonicwall has 3 ports, Lan, WAN, and a dedicated DMZ port, where the dmz devices are suppose to be plugged into. [Manual of sonicwall http://www.sonicwall.com/support/pdfs/SonicWALL_SonicOS_Standard_30_AdminGuide.pdf] Currently I have it setup using the first option I listed below, but want to switch over using NAT instead. The option I’m using is called transparent mode, where you can specify public IP addresses. The manual describes it by saying it bridges the DMZ network onto the WAN interface. I actually have to configure the nameserver with a public ip address this way, and then specify on my dmz port, which the addresses will be connected to it. Second option is of course is using NAT I do have a question using NAT though, and hopefully my terminology makes sense. In NAT mode it looks like I’m suppose to list a private network address and then subnet it to specify what hosts are located on the dmz. If I’m correct on this, does this mean I use a different IP range then my lan. Example: my lan is 10.1.1.0/24 does this mean for my dmz I can use something like 10.1.2.240/28? Thanks for spending the time to figure out my situation

0

First off, if this DNS service is going to be used for both LAN and WAN clients to resolve internal and external clients, you honestly need two DNS servers for security and technical purposes, especially if you start using NAT. At the very least, you'll need two zones, and don't use the same domain name for your internal and external zones. For example, your internal LAN should be domain.local, where as your external should be domain.com or whatever. This is especially important if you get into Active Directory, as it is DNS dependent. "If I’m correct on this, does this mean I use a different IP range then my lan." Yes. Otherwise, neither subnet would know to send traffic to a router to get the traffic to its destination. So back this this whole scenario. If your firewall will block traffic into the DMZ once you go to NAT, you need to open ports for DMZ related traffic. Basically, you need to give yahoo the public IP address your DNS server will be answering to. "Milk was a bad choice!"

0

Alright thanks! I hope to have things running in the next few days. I'll keep my progress posted. Quick question, about how many days does it take for other DNS servers to update on my changes? Or is it immediate?

0

"Quick question, about how many days does it take for other DNS servers to update on my changes? Or is it immediate?" Hosting companies say up to 3 days. Expect most people to resolve your domain within 24 hours. "Milk was a bad choice!"

0

DMZ is setup, and will be setting up DNS soon. Another quick one: Do you see a problem with a DNS server, and a mail server being on the same machine? I believe with my yahoo service I can leave one of their DNS servers as a secondary. If I leave the correct MX records in yahoo, will mail still be directed to the correct address if my DNS service fails (Counting on the server not being crashed)? Also, I see BIND is a more popular DNS solution, then using window's DNS. Should I read up on BIND, or is win2k DNS sufficient enough? Thanks again for your help!

0

"Do you see a problem with a DNS server, and a mail server being on the same machine?" If it's a mail server storing mail, absolutely. You don't want DNS traffic flowing to and from your mail server for security reasons. "I believe with my yahoo service I can leave one of their DNS servers as a secondary." Good idea. Is this a standard secondary in DNS terms? If so, Yahoo's DNS server will host a read only copy of your zone. That will help tremendously for performance, too. "If I leave the correct MX records in yahoo, will mail still be directed to the correct address if my DNS service fails (Counting on the server not being crashed)?" If we're talking standard primary/secondary DNS architecture, then yes, and you control the MX record on your DNS server. Yahoo simply houses a copy of your zone info, with your DNS server being the master copy. "Also, I see BIND is a more popular DNS solution, then using window's DNS. Should I read up on BIND, or is win2k DNS sufficient enough?" BIND is DNS on unix/linux basically. People often use BIND since the underlying OS can be free (most linux distros for example), and can run on older hardware. Windows DNS is fine, especially if you are familiar with how to navigate the management interface for it. As with any server in a DMZ, make sure you lock it down tight. This is particularly important with Windows. Microsoft has security guides for both W2K and W2K3 freely available with prebuilt templates, packet filtering scripts, etc. with descriptions and recommendations for various types of servers. Check them out! Make sure you do the other standard Windows chores like patching to current, run MBSA on the server, etc. Please help survivors of Hurricane Katrina! www.redcross.org

0

"Also, I see BIND is a more popular DNS solution, then using window's DNS. Should I read up on BIND, or is win2k DNS sufficient enough?" There are a number of reasons why this is so. Firstly, historical: most of the organizations using Unix for DNS were doing it before Windows became a realistic option. Secondly, lower cost, as heropsycho2177 said. Thirdly, lower cost of fault tolerance: there's a good argument for putting DNS on a separate computer even in a small network. Windows Active Directory absolutely depends on DNS. It's good to have secondary DNS server/s. Setting up that other machine on Linux or FreeBSD for example is a lot cheaper than buying another Windows license. Fourthly: DNS admin can be accomplished quicker by a skilled Unix/BIND tech. Is W2k DNS sufficient? Definitely. The main thing to recognize is that you can use just Windows, or just *nix, or a combination for your DNS. "If we don't succeed, we run the risk of failure." - BILL CLINTON

0