Security

Ask something
Discussion Locked

DNS security and cable modem

0 helpful
15 replies

by david__ 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I would like some input on different ways to secure a 2000 server connected to a cable modem network.
Setup: single 2000 server running active directory and DNS server on a network of 6 XP pro stations. The server is the root DNS server for the forest. A Netgear router seperates a cable modem from the network.
I would like pointers to setting up the server and workstations to allow for quick DNS resolution of local shares and internet addresses, and yet secure the DNS server from out side access.
The more detail and explanation the better.

Thanks.

15 replies

by meganetcomputers

The best way to secure your 2000 network on a cable network would be to use a router or something else that is compatible with NAT (Network address tranlation) With NAT running and all ports that are not in use closed you will run less of a change of being hacked but the weakest link in your network. You need to becareful of not downloading anything malacious. If you need any further assistance please contact me.

by david__

As I mentioned in my initial question I will use a router. I assumed it was understood it would run NAT (sorry). My focus was how to get reliable and quick name resolution for the lan DNS and internet DNS with the most possible security. IE: setup of DNS on server and config on workstations.

by meganetcomputers

With the number of computers you are talking about you will not see any type of latency with internal name resolution. This is not a problem with only 6 workstations. The default setup of DNS is fine for this situation. You do not need to make any alterations. You will not need to worry about outside access to your DNS server as long as you do not have any type of port forwarding set up and you have all ports that are not being used closed.

by david__

Closeing ports on the router will not be a problem. The workstations will not resolve internet URL's consistnatly unless the ISP's DNS numbers are listed first in the DNS settings, then if ISP's numbers are first then internal name reolution on theLAN is inconsistant, mapped drives and such. If Server is listed first under DNS numbers then the reverse happens. It is like the workstations are not cycleing threough the DNS list properly. Info:the server is setup as the root DNS for the forest of the LAN. What would be the best resolution to correct the name resolution issues, and still be secure, is what my original question was asking. Sorry if it was not clear.
Thanks

by meganetcomputers

Basically when you have your router set up for the cable service all you will need to do is specify the DNS of your provider in the router itself then whenever you make a request for an external page your router knows where to look for this information. Then active directory and your DNS server on your DC will take care of any internal requests. I believe you are look at this in much too much detail. There is not much you will need to do to have this function correctly. I'm running the same type of set up and it works perfectly.

by meganetcomputers

I have my workstations set up with "Obtain DNS server address automatically". If you have it set up this way, The cable provider will provide a set of DNS numbers to your router then through the DHCP request you will receive the same information passed to your workstation. When you log onto your domain all the available shares are sent to the clients workstation. When it is then available for use. The only reason you would have slow access to these shares are because of bandwidth limitations other then that you will not need to work about any changes to your root DNS records.

by Former member

DNS. DNS is not a way to "secure" your server. The best way to secure your environment is to get a firewall or firewall software. DNS is mostly for external lookups, but since u use W2K, you can use DNS on the server internally, for your private addresses. So, your server will be a dns server, and your ISP will be a dns server. Have the clients setup so that your server is the primary DNS server and the ISP server is the secondary, that way they'll do the Win2K auto-DNS-populate thingy and alsobe able to do public domain lookups via the ISP. ANd also this way, no one will be able to do internal lookups on your DNS server on your private network.

by emorse

Try running Wins for internal resolution. This way you can put your ISP's DNS entry first in your workstations list. You will see no performance detriments in running WINS over DNS internally, in fact, I think it is technically a little bit fasterlookup.
- Eli

This discussion is closed to new replies.