need advice on network architecture help linux/w2k

[pollux0]

I have experience w/ both w2k server + linux but need avice on setup of a network for small business. I want to setup a linux firewall/IP Masq. for interanal network (192.168.1.0) for w2k proff. client boxes, printers, dhcp(linux), etc and keep the web hosting servers, dns, etc. on the external IP addresses..

My question is should I set up the Domain Conroller(W2K Server) on the internal network(which i really want to do!)? If so, the where does the email server(Exchange 2000) go, internal IP inside the firewall or outside the firewall? If i am correct, Exchange 2000 needs a domain controller to run. If the Exchange 2000 has to be on the external then i would need to bring an AD outside the firewall(which i dont want to do!).

 

[jwr1096]

Pollux0,
Have you thought about setting your exchange server up on the internal network with a private ip address, and forwarding the required mail ports on the linux firewall directaly to the exchange server. On your DNS specifying the public address of the firewall as the host address of your exchange server. This should allow any external clients/servers to talk directally to your server through your firewall.

Hope this might set you off in the right direction.

Jwr

 

[pollux0]

I was hoping someone would suggest that! That seems like the most logical and secure choice. This setup seems very basic and highly used with most network admins...

on another note, I noticed with a my test network that i did not need an internal DNS for the internal network. I could use the external DNS for both extern and intern. network. I'm assuming however it is more secure to have a dedicated DNS server inside the firewall for internal resolving. Am i correct in my assumptions?

 

[jwr1096]

When you say you did not require DNS on your internal network, were you running an active directory enabled DC at the time.

I would highly sugest that if you are running AD which is needed for exchange 2000 then run DNS on the internal network. This is primarily as AD requires Dynamic updates to DNS to run correctly, and as you are aware their are some worries about the security involved with DDNS.

If you ensure that yor DNS implementation is not configured as a root server then you can enable DNS forwarders and point them to your external DNS thus reducing the ammount of maintanace required.

I hope some of this is of use.

Good luck.

Jwr.