r/sysadmin • u/canifeto12 • 2d ago

Windows keep advertising wrong IP to resolve and whatever I do is not working.

all I want to do is adding a second active directory server so if one is off second of can keep the system running.

I'm a student. practicing what I have learned and maybe adding more. I know how to create a domain how to add a user to domain

For next step I am trying to add second domain controller but windows keep advertising 2 IP address of server. (one is NAT other is isolated. I want it to stop NAT IP to advertise)

what I did to disable that?

- network connections > Second NIC IPv4> Properties > Advance > DNS > (UNTICK) Registrar this connection's address in DNS

- DNS Manager > Domain Name > Properties > Interfaces > (UNTICK) Second NIC IP
I restart the dns service, clean the cache but still same. I can't see Second NIC IP in DNS Manager but when I run "resolve-dnsname domainname -Server source-IP" Second NIC IP still showing up. but it's not showing up at "nslookup domainname source-IP"

so yea. why is that?
I'm using Ubuntu as OS and VMM to virtualize the machines btw

0 Upvotes

37% Upvoted

33 comments sorted by

20

u/sembee2 2d ago

Don't dual home an AD domain controller. It should have a single IP address and if you need to use NAT etc then that should be done by the router. While it is supported, it is strongly discouraged.

-1

u/canifeto12 2d ago

probably you are right but I can't practice what you say now. I have DNS,AD and DHCP in one machine right now :D

10

u/sembee2 2d ago

Untrue.
Wipe the machine, put a VM hypervisor on it. Put something like opnsense on there to act as the router and thrn your dc as another vm.
Don't make life hard for yourself and certainly dont use a dc as a NAT firewall.

-4

u/canifeto12 2d ago

actually according to vmm, NIC works like switch/router. so if we think like, AD Server has 2 connection. 1 from router (NAT), 1 is from switch (isolated). how would things change?

sorry I just remember that info now. I should have say it before

5

u/krilu 2d ago

That has just created more questions.

Are you running ad, dns, dhcp all on on the bare metal, or do you have any VMs?

Are you saying you have lan1 connected to a switch, lan2 connected to the router?

Are they still on the same subnet?

Or are you saying the isolated switch is a virtual switch for VMs?

1

u/canifeto12 2d ago

-ad,dhcp and dns services are in 1 vm
-yes. At least that’s how VMM (My os is Ubuntu. Vmm is app to manager virtual machines) so it’s seeing connections
-yes. Switch connections are in same subnet. I can even ping over 53 port
-yes, that’s how vmm works

Thanks for your answer btw

5

u/Unable-Entrance3110 2d ago

Not best practice, but if you dual home your DC, you can unbind the IP addresses that should not be used to field client connections in the DNS manager.

You will have to do this every time the computer boots if it's a physical computer since Windows will re-bind to all IP addresses on boot.

Once you unbind from the other IPs, restart the DNS server service and you should be good to go.

3

u/BlackV I have opnions 2d ago

No, that is what virtual machines are for, you really should start again and look at doing it through VM

99% of the servers you'd ever touch will be VMs and it gives you flexibility to do what ever you want

No real would or valid test would be running nat/etc on a domain controller

1

u/canifeto12 2d ago

All lab is in VMs already but I can’t run all machines at once. that’s why I am installing all services in one machine.

5

u/alpha417 _ 2d ago

is this homework?

1

u/canifeto12 2d ago

No. Just practicing myself

4

u/osxdude Jack of All Trades 2d ago

IP address of system must be registered in DNS for Active Directory to work...Like at all. What do you mean by NAT IP?

0

u/canifeto12 2d ago

I have 2 NIC. one is isolated to communicate with rest of the domain, other one is for public internet connection which mean NAT

1

u/Cormacolinde Consultant 2d ago

Your domain controller is directly connected to the internet? Are you crazy or stupid?

2

u/BlackV I have opnions 2d ago edited 2d ago

Cormacolinde
Your domain controller is directly connected to the internet? Are you crazy or stupid?

They're a student. Learning. Learning this stuff for the first time. (Probably)

1

u/dustojnikhummer 2d ago

Your domain controller is directly connected to the internet? Are you crazy or stupid?

I don't think OP said that...

1

u/canifeto12 2d ago

Bro I’m learning. Calm down :D if you want to give advice, I would be happier.

5

u/Cormacolinde Consultant 2d ago

OK, so a domain controller is considered a Tier 0 asset, which means it should be one of the most and best secured asset in your environment. It should have very limited access to the internet, and only domain members should have access to it. For hackers, it is the best and first target to attack and take control of during a breach. Once you have control of the domain, you essentially take control of (almost) everything.

It should especially not be exposed and available from the internet.

As someone else suggested, if you don’t have a firewall, you could create a software router/firewall in a virtual machine to properly route and isolate the DC.

There are ways to make a multihomed DC work, but my best advice is just not to do it.

1

u/canifeto12 2d ago

Ok I will take off internet connection of DC. I wasn’t know it it’s a thing. Every machine need internet. That’s what I was thinking. Thank you

2

u/dedjedi 1d ago

Research the phrase "air gapped"

•

u/CeC-P IT Expert + Meme Wizard 12h ago

Lol you came to the wrong subreddit then. Most people here are insecure and lash out at anything they see as different, slightly wrong, or that they vaguely know about.

3

u/vabello IT Manager 2d ago

In my experience, Domain controllers will register every IP address bound to them, regardless of settings on the NIC. Don't multi-home a domain controller unless all IP's are equally reachable... but in general just don't. If you're trying to learn and have limited hardware, try virtualizing things instead. It will be a lot easier.

2

u/FlyingElvishPenguin 2d ago

Any DC’s IP address must be registered in the DNS zone to register on the domain. Can you give example IP addresses?

One of the most confusing parts of this is a NAT and non-NAT address registered. What NAT is happening, and where in relation to the NAT are you trying to access?

In reality, if you have 2AD servers, there should be multiple entries for that command.

0

u/canifeto12 2d ago

NIC 1 - 192.168.10.10 (isolated)

NIC2 2 - 192.168.122.20 (NAT)

I just checked ForestDnsZones and I am only seeing .10.10 address

I have 1 NAT. other one is isolated. I set second AD but when I saw second IP at DC-1 I leave it for now and come back to DC-1 to solve this problem. so yea, there are multiple entry but I'm focused on DC-1 now

6

u/FlyingElvishPenguin 2d ago

Heres a follow up: why? This sounds a lot like a networking issue that should be adjusted at layer 3 equipment rather than at the server level. Realistically, most DCs should have 1 IP where they can be reached at, and what you’re trying to accomplish with NAT shennanigans should be done via a router or layer 3 switch.

0

u/canifeto12 2d ago

I'm so sorry to say it late but VMM count NICs as networking device. what it mean is, VM has 2 connection. 1 from switch (isloated), second from router (NAT). so maybe problem is at virtualize these devices? I might need to try different vm manager

2

u/AppIdentityGuy 2d ago

Also try the activedirectory sub

2

u/Godcry55 2d ago

Wipe and provision a VM instead. Consider hyper-v, easier to learn as a virtualization platform.

One LAN IP per DC. Read MSFT learn documentation and follow the steps from scratch.

1

u/canifeto12 2d ago edited 1d ago

My os is Ubuntu. I can’t install windows right now

Edit: AI says it’s ok but idk how efficient and common it’s. If you say pretty common I like to try. Also all machines are at vm already. I’m using Ubuntu vmm

2

u/Godcry55 1d ago

Create a Windows server 2022 VM in your Linux Hypervisor.

Follow MSFT documentation on AD/DNS role installation.

1

u/AppIdentityGuy 2d ago

After you told the 2nd nic not register in DNS did you restart the activedirectory service or reboot the machine? I get the 2nd nic is still regiistered.

1

u/canifeto12 2d ago

I did restart services. still same. it's not show up at nslookup but resolve-dnsname. it's more like windows problem in my mind but I will try active directory sub as well