1

I have to build new infrastructure for company. Curently there is Gateway/NAT router conected to INTERNET and it provide LAN SUBNET (DHCP, DNS, RevDNS, OpenVPN, and some more not important) inside this subnet i have samba NT4 PDC with fileserver and some workstations, printers, and other devices (in the same subnet). I want to migrate NT4 domain to AD-DC domain (or build new one, if that will be easier). I know that samba have own DNS service (i can provide FQDN for DC), and I don't know how to configure it.

  1. Do I need to run DHCP on DC or on GATEWAY?
  2. Do samba DC DNS provide static DNS for other devices in network in the same subnet?
  3. Can I run samba DC on one interface or i need second (do it need to be NAT for Domains Computers)
    1. How about mobile devices, can users use devices outside networks?
    2. How to provide VPN for Outside users to access fileserver, do it need special config for DC DNS?

1 Answer 1

3

Do I need to run DHCP on DC or on GATEWAY?

DHCP is completely independent from Active Directory; it can be run on any system you want.

Do samba DC DNS provide static DNS for other devices in network in the same subnet?

Yes; domain member computers will automatically register themselves in AD DNS, and you can also add custom static entries through RSAT or samba-tool.

The devices do not have to be in the same subnet.

Can I run samba DC on one interface or i need second (do it need to be NAT for Domains Computers)

The number of interfaces doesn't matter. The domain controller is not a router (unlike perhaps 1980s "LAN servers") – Active Directory DC runs standard TCP/UDP-based services, and devices only connect to it when they need to retrieve some directory information.

Also, unlike old NT4 domains, Active Directory does not use NetBIOS and has no specific subnet or routing requirements. The DC only needs to be reachable through regular unicast IP.

How about mobile devices, can users use devices outside networks?

Technically, yes. AD protocols use standard TCP/UDP and are not constrained to a single LAN.

However, the devices should use VPN to connect to your network for security reasons. (Some AD protocols – DNS, Kerberos, LDAPS – can be safe to expose; others like RPC or CLDAP – not so much. It is probably not the best idea to allow any outside connections to the DC.)

Note that Windows will cache credentials for ~14 days after each successful logon, so mobile laptops can work for short periods of time even without access to the DC.

How to provide VPN for Outside users to access fileserver, do it need special config for DC DNS?

Like with local subnets, the VPN doesn't need special routing, just ordinary unicast access.

As for DNS, the main requirement is that client devices must be able to resolve the AD DNS names. You can achieve this in different ways – either by pushing internal DNS addresses to VPN clients, or by configuring the domain with a globally registered name (such as "ad.example.com"). (I would recommend doing both.)

Various sites say that client devices must use AD DC DNS directly, but that is not a strict requirement. There isn't anything special about AD DNS that would require queries to be made directly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .