"lee720 via WinServerKB.com" <u58994@uwe> wrote in message
news:a5988f576045a@uwe...
> Bill Grant wrote:
>>If you are running AD you should not be using DHCP from a router, and the
>>DC should have a static IP.
>>
> Bill,
> Could you explain more what you mean my one NIC in the
>>private network and one linked to a physical network). Am I setting the
>>NAT router in virtual memory to both my server and workstation. Do I need
>>to create a Virtual private network? How do I link it to the physical
>>network. This is kind of new for me. Any more suggestions can help.
>
> Thanks,
>
> Lee
/201003/1
>
>
NAT is a very simple process. It allows a subnet to share a connection.
It was originally designed to allow a private subnet to share a public
(Internet) connection. Most DSL "routers" are NAT devices which do just
that. It does a simple address translation so that all traffic on the
"public" network uses the IP of the NAT device, not the original client's
private address. The NAT device makes the connection to the remote server
using its own public IP then relays the data to the machine on the private
LAN.
NAT works fine to allow client machines to access Internet sites. The NAT
device looks after the address translation and also forwards DNS requests.
However is comes unstuck if you install Active Directory. AD needs to use
the local DNS, not some public DNS server. Once you install a DC you need to
modify how DNS works. You also need to change how DHCP operates. The clients
need to use the local DNS, not use the NAT device.
There are basically two ways to handle this. If you want to run AD in the
same subnet as the NAT device, you need to have access to the NAT device and
be able to change its settings. If you can alter the DHCP settings so that
it hands out your server's IP for DNS (instead of its own IP) you are in
business. All you need to do is modify your local DNS to forward to a public
DNS service (so that it can resolve foreign URLs as well as local AD
resources) and everything works.
If your NAT device comes from an ISP and they do not give you access to
it, your best bet is to set up AD on its own subnet and install an
additional NAT router of your own. This is similar to running a private LAN
behind a DMZ. There is another subnet between the private LAN and the public
Internet. eg
Internet
|
public IP
NAT
192.168.0.1
|
192.168.0.2 dg 192.168.0.1
your router
192.168.31.1 dg blank
|
DC
192.168.31.11 dg 192.168.31.1
|
workstations
192.168.31.x dg 192.168.31.1 dns 192.168.31.11
Your private LAN has no direct connection to the ISP router. You can run
your own DHCP server if you want because you are in your own network.
You probably noticed that I have not mentioned virtual machines or virtual
networks. That is because you need to do these things regardless of whether
you have virtual machines or not. If you are talking about virtual machines,
the second scenario above is the one I use. With VPC, your private LAN
(192.168.31.0/24) is in local only. Your local NAT router is a vm with one
NIC in local only and one NIC linked to the physical network and the ISP NAT
device. You can use Windows Server with RRAS/NAT or Linux or whatever as
your NAT router.
|