resolution--> stumped = help

[tim]

Hi ppl,

I have a dns problem to which I have looked for a resolution all over
documentations green earth to no avail, I'm stumped and could use a little
help.

I have a dmz and lan network segments with a dsl coming from the internet. I
have a W2K network. The DC is running AD and DNS services (obviously). I
have only one zone (forward lookup) for the lan with its relative reverse
zone for the ptr records. The zones' name is for examp: mydomain.com

The dmz houses my webserver/site (the website goes by the same name as my
internal domain name "mydomain.com) and and my lan with the internal
servers. They are both (dmz, lan) configured with private ip addresses (dmz
172.16.X.X, lan 192.1.X.X). My website is hosted on the webserver on the dmz
and I have nat doing the translation from the internet address to the
internal addressort on the dmz.

Here is where I'm stumped.....all my internal servers and clients are
pointed to the dns on the DC for address resolution (dynamic by the way). I
can resolve out to the internet with no problems, however when I attempt to
to access my website on the dmz I get an html error page.

If I go to the tcp/ip protocol properties and add my isp dns servers and
make it the first one on the list I can access everything on the internet
including my webserver on the dmz but none of my local servers.

Would it be better to set up zones (forward and reverse) in dns for the dmz
webserver and its corresponding records, open communications on the firewall
that will only accept traffic from my lan to the dmz and not vise a versa
????

Would this be the best possible solution???? Opinions suggestions will be
gratefully appreciated...

Stumped
Tim--Mia/Fla.

 

[Roger Abell [MVP]]

You should just use your AD / DNS for internal use only,
with forwarders defined as the ISP's DNS servers (if any,
or just use the root hints).
Then, add a record manually into the zone for the www in
the DMZ.
The issue you have is because the same DNS domain name
is being used for two different purposes (i.e. there are two
of them, your internal and the public). In this situation, one
client is able to resolve names in both version of the zone.