Configuring network & web accesses

[b4u]

Hi,

I need some tips on configuring a network. I'll first describe what I have:


Machine Name: server01
OS: Windows 2003 Standard
Extras: Active Directory (AD), Domain Name Server (DNS), Dynamic Host Configuration Protocol (DHCP), Domain Controler (DC)
IP Configuration:
IP: (Static) 192.168.0.1
SubNet: 255.255.255.0
DNS: None (will use itself, since it's a DNS)
DC Settings:
Domain Name: mydomain.com
DHCP Settings:
Scope from 192.168.0.10 to 192.168.0.30
DNS Settings:
On "DNS\SERVER01\mydomain.com" added the following keys:
Name "www" / Type "Allias(CNAME)" / Data "server01.mydomain.com".
Name "ftp" / Type "Allias(CNAME)" / Data "server02.mydomain.com".

This will be a web server (intranet & internet). It will run Tomcat on port 80.
If I "ping server01.mydomain.com" and "ping www.mydomain.com" they ping successfully into 192.168.0.1.


Machine Name: server02
OS: Windows 2003 Standard
Extras: Some FTP server software
IP Configuration:
IP: (Static) 192.168.0.2
SubNet: 255.255.255.0
DNS: None

This will be an FTP server (intranet & internet). It will run some FTP server software on port 90 (don't know which port, isn't installed yet).
If I "ping server02.mydomain.com" and "ping ftp.mydomain.com" they ping successfully into 192.168.0.2.


Machine Name: work01
OS: Windows XP Pro SP2
Extras: None
IP Configuration:
IP: (Dynamic) 192.168.0.10 (leased from server01)
SubNet: None
DNS: None

This will be a regular workstation machine.
If I "ping work01.mydomain.com" it'll ping successfully into 192.168.0.10.
There are some other machines like this one, named work02, work03, ..., with similar config.


General Notes:

Every computer belongs to mydomain.com, users are created in server01 under Active Directory administration console, and everyone logs on successfully.

All users belong to DomainUser group, one user (me) belong to DomainAdmin group, and some are Administrators on their working computers.


Network:

To connect all the machines, I have an 8-port switch from Linksys.
I'm thinking about buying a "4-port cable/dsl router + wireless" from Linksys.
I'll then Uplink last port from my Linksys (the one Uplinkable), into the first port of the router.
I'll then connect an RJ45 cable from the cable modem into the WAN port of the router.
Then I assume all my network will automatically have access to my cable internet connection.
My ISP gives my cable modem a fixed IP of for example: 213.80.84.13.



I assume everything above is correct, so I'll move on to my real questions:

Question #1

How can I setup my network, so that only users logged on mydomain.com can access my internet cable connection?

And how can I restrict a particular user/computer?

I want to give access to everyone that righfully belongs to the domain, but still be able to reject someone. I mean if I reject a machine (for example work05), the users that log to domain on that specific computer cannot access the internet. They cannot change computer name, because if they do, they would need DomainAdmin password to rejoin the domain, right? And since they are NOT DomainAdmins, they could not trick the system by simply changing machine name.

Maybe by setting a proxy that asks user/password to connect to internet? Then I would only allow some restrict group of users (that belong to domain, like MYDOMAIN\user01 or something like that), and only those would be able to give their passwords to proxy and actually pass them. They would then be able to have internet from every machine, as long as they provide their passwords. Right? How could I set this up then?


Question #2

So with a router, people from the internet would not be able to enter my network. I mean, they could only find my ISP IP (213.80.84.13), but trying to enter my network would fail, since my router would not have allowance on it's NAT table to allow the packets to flow in. That's the concept of a router as I understand it, and acting "as a firewall".

But I need to allow it to some extent ... I want requests made to port 80 be handled to server01 (for www) and requests made to port 90 be handled to server01 (for ftp).

How/where would I set this up?


Question #3

Maybe this has something to do with Question #2 ... but here it goes ...

Since I have a fixed IP from ISP, and I want to run a web site from my servers, I'm interested in registering a domain name for my company.

But instead of registering www.mycompany.com, I want to be able to register mycompany.com pointing to my fixed ISP's IP (213.80.84.13).

When someone calls http://www.mycompany.com, the request would be mapped from mycompany.com to 213.80.84.13, then it was my local network (my own DNS server, server01) that would resolve the specific part of the address, like the www, ftp, ...

This first part would be sort of configure my router to finish handling Domain Names by server01 ... or something like that. How?

Will I be able to do that with this setup? What do I have to make? Register only mycompany.com on some internet domain name server provider? It's that simple, or do I have to do something else?


Question #4

Let's say for example that my web site just get's to requested. I want to split it in two ... so I install another server (like server03). How can I make my network or my server01 to split web page requests also to server03?



Many questions, I know, lot's of text to read ... eheh ... but I would appreciate some help on doing this and understanding how it's done.

If you need some more info, please just ask for it ... I'll edit it into this message so it will get more complete.


Thank you very much.

 

[phillc]

Answer #1 - Sorry, no real answer here. You may be able to use GPOs to prevent local accounts from loging on.
Answer #2 - Go into your router's interface, usually a web page at your default gateway's IP. You should be able to enter NAT translations in the form of port # = private IP. It is a really simple process but the exact approach will vary depending on your router.
Answer #3 - Just register mycompany.com and provide your public IP to the register. The requests for your domain will translate to your IP address and your router will forward it to the correct server. Http would be forwarded to server01 because you will set up NAT to forward port 80 requests to the IP of server01. DNS could be messy. You can forward DNS (port 51?) through your router to Server01. But it would know ftp.mycompany.com as 192.168.0.2 which is useless on the internet. I'm pretty sure you'll need a public IP for each server that you want a subdomain to resolve to.
Answer #4 - No real expirence. Windows 2003 cluster? Never worked in this kind of envioroment.

 

[b4u]

Thank you for the answers. Forwarding DNS port from the router to a NAT could be an alternative ... I'll definetly check it out. However, I believe there must be some simpler way of resolving address names internally ... or many companies like microsoft would have to register lot's of domain names, like www.microsoft.com, support.microsoft.com, ...

I do believe that companies with that sort of config will resolve their own final destinations inside their networks.


* bump for more answers *

 

[Wizkid]

1. Give Microsoft ISA Server a try, I believe it will do what you want.
2. There is no way to allow anyone on the internet to access to private IP addresses. The best way to allow www/ftp to work is to go with phillc's suggestion and forward port 80 to your web server, etc.
3. You will need to provide your public IP as the nameserver for that domain. Then you need to configure your DNS server to provide your PUBLIC IP for outside requests to www.yourdomain.com. If you return 192.168.x.x then it won't work. I believe you can setup DNS to return 192.168.x.x for internal requests and 213.80.84.13 for external requests (from the internet). This should do what you want.
4. You are going to run out of bandwidth before you need load balancing. However, round-robin DNS may be the easiest/cheapest way to do it. Just set DNS to give more than one IP for www.whatever.com and it should "automatically" load balance to some degree.


Edit: don't forgot to forward port 53 TCP&UDP from your router to your DNS server for internet dns queries to get through.

 

[b4u]

Originally posted by: Wizkid
3. You will need to provide your public IP as the nameserver for that domain. Then you need to configure your DNS server to provide your PUBLIC IP for outside requests to www.yourdomain.com. If you return 192.168.x.x then it won't work. I believe you can setup DNS to return 192.168.x.x for internal requests and 213.80.84.13 for external requests (from the internet). This should do what you want.

So a web user hits http://ftp.mydomain.com, I have mydomain.com registered to my public 213.80.84.13 IP, and the request goes to my router (asking where the hell is http://ftp.mydomain.com on port 53).

My router forwards the request to server01 (192.168.0.1), who says "hey, http://ftp.mydomain.com is on 213.80.84.13".

The client (user) then receives this info and says "great, so let's go to that IP 213.80.84.13 (for the second time), using port 99 (whichever port ftp is)".

My router receives a request to port 99, and forwards it to server02 (192.168.0.2) on port 99.

Is that it? So I only need to specify my DNS alias to my public IP, and forward the ports on the router. Right?

But then I would loose www and ftp redirects inside my local network ... since DNS would send them to 213.80.84.13, which is an invalid IP for my local network.

Originally posted by: Wizkid
Edit: don't forgot to forward port 53 TCP&UDP from your router to your DNS server for internet dns queries to get through.

Got it Good thing you remembered me.

 

[phillc]

You should be able to have DNS entries for www = 213.80.84.13 and www = 192.168.0.1. I think I've done that before.

Technically, I think you are supposed to have a public and private DNS server, so that people on the outside don't see you internal network structure, but I don't think that will be a concern in such a small enviroment.