I have a windows server that's on the domain which has been put in a DMZ. All traffic from the internal network is allowed into the DMZ, but everything initiated from the DMZ heading in is blocked. I've recent installed a backup agent on the DMZ server that needs to regularly check in. I know how to open the appropriate ports for that check in to happen. The problem being that the DMZ server cannot resolve the address of the internal backup server, in order to check in. What is the best practice here? Should I open up my internal dns server to my dmz?

closed as primarily opinion-based by Ricky Beam, YLearn Sep 24 '15 at 4:24

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You're asking for personal opinions. Is it safe to permit DNS out of the DMZ? Maybe. Only you can know that. IMO, if the backup server has a static address, just put it in the DMZ'd system's hosts file. – Ricky Beam Sep 23 '15 at 19:15
  • I always like the option of running backups on their own separate networks/interfaces when possible. That way backups don't impact any production traffic. In any event, your question is asking for opinions and we are unable to provide a correct answer. Please edit your question and it will automatically start a reopen vote. You may find our Question Checklist helpful to improve your question. – YLearn Sep 24 '15 at 4:23
  • @YLearn I suppose I am asking for opinion here, and its not really on topic... its more of a "should I" vs a "how can I". Should I delete question? – Pete Sep 24 '15 at 18:06
  • @Pete, that would be your call. You could also edit the question to make it less opinion based. Rather than "should I" you could ask a "how can I" type question, although here you would need to keep it specifically to the networking side of things to stay on topic. – YLearn Sep 24 '15 at 18:37
  • @YLearn I think I will just delete it, as I know how to accomplish it. Thanks for the feedback. – Pete Sep 24 '15 at 18:45

That's one way. Another would be to place the IP address of the backup server in the server's host file so that it doesn't need to do a DNS lookup.

  • I've considered this. Its actually how I have a few test servers set up for other services. It just seems a little more difficult to maintain or fragile. – Pete Sep 23 '15 at 17:35
  • You could ask about server-type stuff like that on Server Fault. as far as the network goes, you can open the firewall for DNS, Check with the server guys about what they think. – Ron Maupin Sep 23 '15 at 17:41
  • Fair enough, I was unsure if the question was even on topic here. Thanks! – Pete Sep 23 '15 at 19:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.