Windows Forum

Ask something
Discussion Locked

FireWall-1 and MS DNS

0 helpful
4 replies

by timber 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I just implemented Firewall-1 ver. 4.1 on a Windows NT Server. The firewall runs great however I tried to move my two DNS servers behind the firewall yesterday and had severe problems. I set up the rules just as I did for my web servers that I moved with the exception of using DNS service instead of web services. I am using automatic NAT. When I moved DNS 2 (my secondary DNS Server)DNS 1 (Primary) preformed nonstop read /write hard drive activity. When I moved DNS 1 behind the firewall theactivity did not stop and noone inside or outside the firewall could acces our internal web pages.... Internal clients could not access the internet either. What did I do wrong?? Any ideas???

4 replies

by otto3

Without knowing more specifics about the your network, it seems that you should use static NAT for the DNS. Check in the logs to see what happens to the DNS traffic. You might have the correct firewall setup, but missing a route from the external address of the DNS server to the internal address of the DNS server. In that case do a route add:

route add -p 111.111.111.x 192.168.1.x

This would allow the firewall to find the DNS server. Look up the route add command syntex, my sample might incorrect.

Otto

by timber

Decided to just leave those DNS servers outside the firewall and put up an internal DNS Server.

by otto3

Oops.... For static NAT you'd also need a local.arp file on the firewall for the valid external IP of the DNS servers. Alternatively, you assigned two more external IP addresses for the firewall's external NIC under NT. That would work also.

Otto

This discussion is closed to new replies.