Home / server / Questions / 449660
Accepted
Felix
Asked: 2012-11-17 22:07:32 +0800 CST

dns in a small network with router and AD domain

  • 772

I have a small office network with router (running OpenWRT), Windows Domain Controller (used to be 2008R2; I just backed it up and upgraded to 2012), about a dozen AD clients (3 server and windows workstation) and several non-AD clients (network printer, PBX).

The problem is that the clients can't access servers by name (only by IP). I tried all kind of permutations. Right now domain controller runs DNS server for all desktops; but unless I put an entry in hosts file - I can only get by IP. I have router as DHCP server (since not all devices are on AD); and except for Domain Controller all IP addresses, including "static", are assigned by the router.

Most frustrating, some servers sometimes just work! for example, I can often get to the Linux box by name (it is part of Domain using Beyond Trust Integration Services); but I can never get to SQL Server box. Seems like non-domain devices see more names than domain members...

This network should be fairly typical; but I couldn't get any guidance about how to set up DNS/DHCP service to make all nodes happy. The closest is this question, but still it's different!

Thanks

domain-name-system

3 Answers

  1. Best Answer

    I'm a little confused by some of your terminology:

    "and except for Domain Controller all IP addresses, including "static", are assigned by the router." -- uh... no. If the router is assigning addresses then they're not static.

    "I have router as DHCP server (since not all devices are on AD)" -- Not sure why you've done this. Devices do not need to be a member of an Active Directory Domain to use DHCP services provided by a Windows server.

    As for "how to set up DNS/DHCP service to make all nodes happy",Ii should be very simple.

    • A Windows server, probably the domain controller on a small network, should be providing DHCP.
    • The domain controllers (ideally you'd have more than one?) should have the DNS role installed and configured to support AD, and DNS should forward any requests it cannot resolve to the ISP's DNS servers.
    • The clients should have their DNS settings configured to point to the DNS server, and their gateway should point to the router.
    • Local firewall on each windows system (server or client) should either be disabled or, more ideally, should be correctly configured to see the whole of your internal IP address scheme as a workplace network, with an appropriately configured domain profile.
    • 7

  2. This is a fairly simple issue to resolve. Disable the DHCP service on your router or enable the option to forward the DHCP calls to the AD server. In order to have name lookup work you really need to have two aspects enabled. This is a assuming that you already have a DNS server enabled in the AD (which is required for AD functionality) and it has all of the DNS forwarding setup correctly for DNS inquiries beyond your AD.

    First you need to have all of the workstations requesting DHCP addresses get the address requests from a DHCP server which is part of the AD. The DHCP server once registered in the AD must be first trusted/authorized and then have the option enabled to dynamically update the DNS server as it registers DHCP leases. This will allow the DNS server to dynamically update the A records for your domain in DNS. You may want to enable the reverse registration as well as that will update the PRT records as well. Be sure to make sure you are appending the domain suffix to your hostname in your settings as well.

    The second step is the easy step. You then must use your AD DNS server for all of your DNS queries. At least it must be the first of your name servers. You can technically have as many as you want. However the AD DNS server must be first. You ISP DNS servers I suppose could be the second entry if you need to have one.

    In doing this you enable your workstations to lookup local domain hosts using just the NetBIOS address or the FQDN as the DNS server you are working against is dynamically registering the other workstations, printers and other AD assets as they claim DHCP leases. The dynamic registration is critical so as the DHCP lease expires and a new lease is issued, potentially changing the IP address of the workstation, the new information is updated in to the AD DNS entries.

    Good luck.

    • 2

  3. What I like to do is to set up DHCP in the wireless router for the wireless client hosts. I'll run two scopes, each unique to the LAN subnet and each in its own VLAN, one for a private wireless network and another for a guest wireless network. Then, in the router, I will route the private wireless network to the LAN subnet, and deny the guest wireless network to the LAN subnet, giving guest wireless users only internet access and no access to LAN/domain resources. This way the wireless networks are on separate segments of the network, giving me greater control over the traffic for security, prioritization, reporting, etc. I always run DHCP on a Windows domain on the Primary Domain Controller for the LAN, with auto-registering for DNS, as described.

    This would create a situation where wireless hosts on the private wireless network would not register in domain DNS, but usually hosts on the LAN do not need to access PC hosts on the LAN with name-based resolution. Usually this is only needed for server resources, or printers or other hosts that require access by all LAN users/hosts.

    • 1