How can I stop a multihomed domain controller from advertising its NAT IP?
Asked by
MellowCedar42
I'm practicing Active Directory in virtual machines on Ubuntu and currently have DNS, DHCP, and AD running together. I want to add a second domain controller for redundancy. The first controller has two NICs: 192.168.10.10 on an isolated domain network and 192.168.122.20 on a NAT network for internet access. I want only the isolated address advertised in DNS. I disabled DNS registration on the NAT adapter and removed that interface from the DNS server's listening interfaces, then restarted DNS and cleared the cache. The NAT address no longer appears with nslookup, but Resolve-DnsName still shows it when querying the domain name directly. Why are the results different, and what else should I check?
Answers
A domain controller’s usable address generally needs to be registered in DNS for AD to function correctly. On the NAT adapter, disable “Register this connection’s addresses in DNS,” and leave registration enabled on the internal adapter. Also verify that DNS is listening only on the internal address, then remove any stale host records and restart Netlogon or reboot the controller. Check for manually created A records as well, since those are unaffected by the adapter setting.
Reply to this answer
The safest recommendation is not to multihome a domain controller. AD and DNS expect the controller’s addresses to be reachable by domain clients, and having one interface behind NAT can cause registration, authentication, and replication problems. Give each controller one address on the internal network, and let the router or virtualization setup provide internet access separately.
MellowCedar42: That makes sense, although I’m using this small lab to practice with limited virtual hardware. I currently have DNS, DHCP, and AD on the same machine.
Reply to this answer
The difference may be caused by the commands querying DNS differently. Resolve-DnsName can return multiple records, consult cached data, or query a particular DNS server directly, while nslookup may be displaying a different response or record set. Run both commands against the same DNS server, check the hostname’s A and AAAA records, clear client and server caches, and allow time for stale data to expire. Even if you can suppress the extra record, a multihomed domain controller is usually fragile unless both networks are equally reachable.
CopperVale31: I already restarted the DNS service and cleared the cache, but the extra address still appears only with Resolve-DnsName. I’ll also check Netlogon registration and any static records.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar42: The internal adapter is 192.168.10.10 and the NAT adapter is 192.168.122.20. I only see the internal address in the ForestDnsZones records, but the NAT address still appears in some Resolve-DnsName results.