I have to agree with the ... non-recommendation.
If a system authenticates internet access against internal accounts, user
accounts names will be found (through wrong password responses). Accounts
with lockout policies can be disabled, or if no lockout policy exists,
internal accounts will be cracked without even having to penetrate the
internal network. Very useful if you're also running a PPTP server.
I'm sure you're aware of this, and are just following orders, so anyway,
here's the description for NodeType as referred to previously:
NodeType
Key: Netbt\Parameters
Value Type: REG_DWORD - Number
Valid Range: 1,2,4,8 (B-node, P-node, M-node, H-node)
Default: 1 or 8 based on the WINS server configuration
Description: This parameter determines what methods NetBT will use to
register and resolve names. A B-node system uses broadcasts. A P-node system
uses only point-to-point name queries to a name server (WINS). An M-node
system broadcasts first, then queries the name server. An H-node system
queries the name server first, then broadcasts. Resolution through LMHOSTS
or DNS, if enabled, will follow these methods. If this key is present it
will override the DhcpNodeType key. If neither key is present, the system
defaults to B-node if there are no WINS servers configured for the network.
The system defaults to H-node if there is at least one WINS server
configured.
For lowest latency use P-node with the previous LMHOSTS recommendation.
Bill Stout
-----Original Message-----
From: Roger McLaren [mailto:RMcLaren@vcss.k12.ca.us]
Sent: Tuesday, August 24, 2004 10:37 AM
To: bdar@pbad.sbg.com.sa; firewalls@securityfocus.com
Subject: Re: unable to join domain from dmz
Bilal,
I won't ask why you are adding to an NT4 domain or why you are putting
a Domain Controller in your DMZ (Neither of which I would recommend).
NT4 domain browsing is based on network broadcasts. Broadcast messages
will not cross routers or firewalls. If you are not using WINS, you may
simply need to add a line to your LMHOSTS file similar to:
199.199.199.1 ComputerName #PRE #DOM:DomainName
See the folllowing Microsoft Knowlege base article for more info:
http://support.microsoft.com/default.aspx?scid=kb;en-us;150800&Product=nts40
Hope this helps
Roger R. McLaren
Systems Support Analyst
Information Technology Services
Ventura County Superintendent of Schools
"Bilal Dar" <bdar@pbad.sbg.com.sa> 8/23/2004 2:12:52 AM >>>
I am having a problem, i couldn't figure out the reason till now. We
are
having our NT 4 Primary Domain Controller on the inside network, now i
am
installing another server in the DMZ as a Backup Domain Controller.
When i
try to join the domain during installation i get an error stating "The
domain controller for the domain cannot be located"
Dmz = 172.17.0.0/16
Inside = 172.16.0.0/16
PDC = 172.16.4.2
NewServer = 172.17.0.10/16
conduit permit icmp any any
conduit permit ip host 172.17.0.10 172.16.0.0 255.255.0.0
conduit permit ip host 172.17.0.10 172.17.0.0 255.255.0.0
conduit permit tcp host 172.17.0.10 eq smtp any
conduit permit tcp host 172.17.0.10 eq pop3 any
conduit permit tcp host 172.17.0.10 eq domain any
conduit permit udp host 172.17.0.10 eq domain any
conduit permit ip host 172.17.4.2 host 172.17.0.10
I can ping NewServer from Inside network. Am i missing something?
Thanks
