Setting up DNS on Windows 2008 R2

J

jdraughn

Limp Gawd
Joined
Mar 9, 2007
Messages
324
Hi all. In the past I have used a free DNS service to point toward my home web server. I have a static IP, which my router uses and then assigns 192.168.x IP's to all computers on my network, including my web server. When I tried to install the DNS functionality on the web server it came up with a warning stating I should not continue unless I had a static IP, so I canceled the installation until I could figure out what to do. I did make the web server IP a DMZ in my router.

How do I give my server a static IP when I only have 1 and my router has it?
 
You can use port forwarding. DNS uses TCP and UDP port 53 for incoming packets. So basically any packet with the destination of your_ip_address:53 will be sent to the host in your network that you assign, which is your server. You should probably take you web server off DMZ and forward TCP ports 80 (HTTP) and 443 (HTTPS) to that too. But be careful, lately people have been getting a lot of requests from IPs that are from the other "side" of the world.
 
It wants the local host to have a static IP (your server)...meaning your servers LAN IP should be static. (example..192.168.1.10). So that it can be handed out with certainly to clients.

And I HIGHLY recommend that you forward only the port(s) necessary to make the service(s) on your server available on the outside. Many "home grade" routers...when you put a computer in the DMZ...that means all 65,000 plus ports are exposed from behind NAT. And to do with that a Windows box....a Windows Server none the less....holy freaking crap you'll be wanting to format that box on a monthly basis due to it being hacked. Only open/forward the necessary ports you need...example...port 80 (although that's dangerous enough by itself if not properly secured).

However...reading your post again...I suspect you may not have the right idea of DNS....what are you goals for installing it?
 
YeOldeStonecat said:
It wants the local host to have a static IP (your server)...meaning your servers LAN IP should be static. (example..192.168.1.10). So that it can be handed out with certainly to clients.

And I HIGHLY recommend that you forward only the port(s) necessary to make the service(s) on your server available on the outside. Many "home grade" routers...when you put a computer in the DMZ...that means all 65,000 plus ports are exposed from behind NAT. And to do with that a Windows box....a Windows Server none the less....holy freaking crap you'll be wanting to format that box on a monthly basis due to it being hacked. Only open/forward the necessary ports you need...example...port 80 (although that's dangerous enough by itself if not properly secured).

However...reading your post again...I suspect you may not have the right idea of DNS....what are you goals for installing it?
Click to expand...

what he said. a dns server cant have a dynamic ip address. and the dns server you are setting up is a local dns server. it will only handle local dns requests from local pc (pc's on your lan). it isnt going to be out on the web pointing people to your web server. also, i wouldnt put you server in a dmz. the hits that thing will get will be crazy!! with my home server i am getting about a thousand attacks a day, and that is only with the router only forwarding the ports needed to the server. if all 65000 ports were forwarded it would be 10000+ attacks a day!!

http://hardforum.com/showthread.php?t=1715569
 
Good security policy is to forward only the needed ports through a firewall for ANY edge OS. I have multiple Server2k8r2 edge machines and none have been hacked. Putting any machine, any OS on the edge with all ports open is asking for trouble- OS is a minmal factor.
Don't forget, WinServer 2003 and newer has a built-in firewall, progressively better with newer releases. Most ports are closed by default.
Just to be clear, I suggest a dedicated security appliance (such as pfSense) and then your edge devices and the rest of your network behind it.
Tricky and YeOlde have good advice and information on actual usage of your DNS server for your LAN
 
RocketTech said:
Don't forget, WinServer 2003 and newer has a built-in firewall, progressively better with newer releases. Most ports are closed by default.
Click to expand...

Not pertaining to topic since OP has Server 08...but the firewall on Server 03 would only enable if you had it multi-homed...(at least 2x NICs enabled and setup)...it assumed the horribly crappy ICS/RRAS was being used. The firewall service will not start on Server 03 with only 1x NIC enabled.
 
You might want to learn about how NAT and RFC 1918 addressing works before you try to set up DNS.

If you have a static world routable IP, you will be fine. You'll need glue records on your domain, which you can set up with your registrar.

Your server on the NATed network needs to have a static "internal" IP address, i.e. 192.168.1.200, set through its network configuration, not assigned by DHCP.

You do not need a DMZ. Do not use a DMZ. All you need is a single port forward on 53, UDP (yes, you "should" forward TCP as well, but less than 1% of all DNS traffic comes in over TCP)
 
You must log in or register to reply here.
Back
Top