1

I'm planning to apply the network address translation on a router between hosts and AD/DNS server in an organization. It seemed that this scenario is complicated for a private network.

The topology will be similar like this figure below:(client PCs or even some servers located on the left side while the AD/DNS server deployed at the right side.) enter image description here

The NAT is planned to be configured on router0 and the left side interface will be treated as "insdie"

I' just read article this one and this.

my questions are:

  1. if NAT is configured for both directions(bi-directional) between client hosts and AD/DNS, will this scenario work with without issues?(assume other settings are correct)

  2. is it actually no problem if the NAT is configured one-way from client hosts to the AD/DNS and the traffic will work just fine?

Improve this question
6
  • Is the routing in the diagram the real situation or is it really two routers connected across open internet, represented by router0?
    – jonathanjo
    Commented Dec 19, 2019 at 16:42
  • You need to avoid NAT. Only use NAT if you must (private to public or overlapping addressing).
    – Ron Maupin ♦
    Commented Dec 19, 2019 at 18:21
  • the routing will be like what the diagram showed.Yes. However, this topology is located only in a private network, it is not crossing the internet.
    – user53815
    Commented Dec 20, 2019 at 2:18
  • @RonMaupin So this scenario is never an ideal setting and the NAT is not suggested to be applied in a private-to-private format within a site?
    – user53815
    Commented Dec 20, 2019 at 2:23
  • NAT is a kludge to extend the life of IPv4. You should only use NAT when you must for overlapping addressing (should be temporary until the addressing can be fixed) or in the case of public/private addressing. Other than that, simple routing should work. NAT just throws in unnecessary complications, it only works with TCP, UDP and ICMP, and it can break applications and application-layer protocols, even some that use TCP or UDP.
    – Ron Maupin ♦
    Commented Dec 20, 2019 at 2:27

1 Answer 1

Reset to default
1

It seemed that this scenario is complicated for a private network.

Not at all. Just make sure you don't use NAT. If there are connections between locations across open Internet, use tunneling (VPN) instead.

is it actually no problem if the NAT is configured one-way from client hosts to the AD/DNS and the traffic will work just fine?

In your diagram, assuming public addressing and NAT between Router0 and Router2, Router0 would need to apply source NAT and Router2 destination NAT (port forwarding, reverse NAT) for UDP port 53 towards Server0. Additionally, you'd probably want Router2 to accept DNS requests only from Router0. Also, the DNS client would need to be set up with Router2's public IP as DNS server.

Trying to run an AD domain controller like that won't work since it requires more than DNS.

So, don't NAT but tunnel.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.