2019-01-08

Cannot Access Public Website due to AD Domain

Lately it is getting more popular to drop the www from your public domain; this means that www.contoso.one becomes contoso.one
For a lot of the smaller domains that I work with, that means the public website is the same place as their domain controllers inside the network, which causes problems. 

The ideal solutions to this are to either 
  1. Host your AD off a subdomain, like ad.contoso.one 
  2. Don't redirect www.contoso.one to contoso.one on your website
But that doesn't work well for an existing domain. AD migrations are not a simple endeavor, and as I mentioned before, dropping the www is the hip thing to do. 

As a quick work around, I found out about the netsh portproxy capabilities. 

Simply put, this lets the server listen on a port and forward it to another hostname or IP address - we can use this to listen to port 80 and 443 on the domain controllers and forward the traffic to our public website. Keep in mind that when you `nslookup www.contoso.one` you need to get the correct IP address for the website. 




This will look up the hostname www.contoso.one, and forward the traffic received on ports 80 and 443 to it. However, these port forwards are lost on reboot, so I used a Scheduled Task to run the script on startup and once an hour to setup the port forwards.

You could easily change these commands to run directly from the Scheduled Task, amd/or push the Scheduled Task through GPO to all domain controllers.
Here is a quick Scheduled Task that you could import to run on system startup.

There are more benefits to moving AD of to it's own subdomain, like being able to let normal public DNS come through, but still override interior records for internal connections to things like Exchange or internal hosts.

To read more about pushing these out to all Domain Controllers automatically, check out this post

No comments:

Post a Comment

Putting your public website on your Domain Controllers .... Sort of

In a post a while back I talked about a current trend to move websites from www.contoso.one to just contoso.one . The method I outlined in t...