DNS

[dtk3]

Hello. I have configured a Win 2000 Server with DNS. Currently, users pc's are pointed to the DNS server within their network settings. The Win 2000 Server seems to pass along the ISP DNS server IP's to the users therefore allowing them to have access to the internet. I would like to disable this 'passing' so that our server does not give the pc's the ISP DNS IP's. I've looked around and can't figure out how to do this. Does anyone know?

Thanks!

DTK3

 

[Castor66]

Are you using DHCP? If so, configure the DNS servers in the DHCP Server Options. Put the addresses of your internal DNS servers in there - Scope Option 006 DNS Servers.

If they are static IP's then just set them to use your own DNS servers.

Be aware your DNS may be configured to forward any unresolved requests to your ISP DNS servers anyway so they can still access the Internet.

 

[technome]

If your workstations are set to your internal DNS servers only as preferred and alternate, or through the DHCP options, they will not seek queries from DNS servers on the Internet. They are forced to rely on your DNS servers for answers.

On the server...
In the forwarding settings, with your ISPs DNS servers placed as entries, set "Do not use recursion". This forces your DNS servers to only go to the ISPs DNS servers for a query answer, a bit safer then allowing your DNS servers to query any old DNS servers out on the Internet. Safer in the sense there are fake DNS servers, which could introduce virus code to your DNS servers.

 

[mrmoneymatters]

Are you just trying to stop everyone from getting on the internet? If so and you are on one local network, remove their default gateway.

Network Admin
A+, Network+, MCSA 2000, MCSE 2000

 

[dtk3]

Hello! Thanks for all the information. What I ended up doing is just taking out the gateway as was mentioned. Initially the pc still had a connection to the internet after taking the gateway IP out so I had to go into DOS and delete the route table entry

0.0.0.0 0.0.0.0 gateway IP users pc IP

Just in case someone else ever has this problem just open up DOS and type "route print". You should see something like the entry above. Then type "route delete 0.0.0.0" to take the entry out.

The internet should no longer work on that station.

Thanks again.

Cheers
DTK3

 

[Castor66]

To be honest that's a pretty kludgy way of stopping internet access. There are much better ways out there. For example, putting in a decent cheap firewall, e.g. smoothwall, as your default gatewya would be a much better idea.

As a sys admin you should have as much centralised as possible. Centralised = controlled!