Trying to run DNS with a Firewall

[Troy Blangin]

I am trying to run a DNS server with a firewall up. We thought we needed to just telnet to the firewall and login to the firewall then run the DNS server on the HP machine. When we move in the resolv.conf in the /etc directory and bring up the DNS server we are bringing down the performance of the production machine. How to we get DNS to run through the firewall? Hopefully someone can help me. Thanks.

[Albert E. Whale, CISSP]

Troy,

Are you attempting to run DNS through the Firewall? - In which case you'll need to open a Port for it.

Are you trying to run DNS independently? - In which case your DNS Masters will not know of an outsie universe and will become the Root Master Servers to the . domain.

Hope this helps.

[Mike McKinlay]

When you say run DNS through the firewall, do you mean you want DNS lookups from internal systems to be performed against an external DNS, such as your ISP?

Or do you want to run DNS on your firewall to serve out internal addresses (those few you want to publish to the web) and to provide lookup services to both sides of the firewall?

[David Rodman]

You have three options with a firewall and DNS ( maybe more on variations)
It depends on how paranoid and what functionality you want.
You can open a hole (port) for DNS as suggested earlier. Any one outside
can query your server directly. - with associated risks.

You can run your Domain on the firewall (make it the master) - then the outside
and inside point to the firewall for resolv(s) -

You can run a caching server on the firewall and your master domain on an inside
machine. This way you can resolve outside addresses, but no one can get your
inside addresses.

Other variations exist - esp if you have a DMZ.

[Troy Blangin]

Thanks David. I will try one of those three options. If I need any more assistance I will let you know. OK. Thanks again.

[alberto vasquez]

Troy,
If you do need additional advice, try
posting this to the network forums also.