NT Trusts Across a Firewall

[BarryStiefel]

NT Trusts Across a Firewall



Question



I've been given the ultimatum to either make NT trusts work through our firewall, or remove the firewall and run wide open. We've been asked with setting up NT trusts between the local site and our parent company (who have no firewall and are using router-based packet filtering). I've spent a few hours reading through all the material I could find. Oh, and before anyone mentions it, I have suggested implementing a second firewall at the parent site and setting up a VPN. This was shot down with very little consideration...

Answer



If you were to take out your firewall, would you have enough legal addresses for everything at your site? If not, your firewall may very well be a necessity. At worst, you could move your domain server(s) outside the firewall and set up special rules permitting access without NAT to and from your inside network. You'd also have to set up static routes on the outside domain servers so they knew how to talk to the inside network. For extra protection, I'd turn on some packet filtering and anti-spoofing on your router. Not the most optimum solution, but one that can be made to work.

If you were to set up an IPSEC VPN between the two sites, you could make it work provided you turned off NAT between the two sites. NT Trusts can be established by simply modifying the LMHOSTS file (%SystemRoot%\SYSTEM32\DRIVERS\ETC\LMHOSTS) on each Primary Domain Controller (PDC) with the following entries (alternatively, both domains can share a common WINS server):

x.x.x.x "DDDDD \0x1B" #PRE #x.x.x.x= IP of PDC, DDDDD=Name of Domainx.x.x.x SSSSSS #PRE #DOM:DDDDD #x.x.x.x= IP of PDC, SSSSS=Name of PDC

IMPORTANT: Edit LMHOSTS file with edit.com (NOT notepad) and make sure that the domain name (in quotes) is padded with spaces to exactly 15 characters before the \0x1B.

You'll need to reload the netbios cache (nbtstat -R) or reboot.

In FireWall-1 4.1, you can enable NetBIOS over NAT support (which will be necessary if using an FWZ-based VPN or any other situation will NAT will be needed) by adding the following to the :props( section of objects.C:

:netbios_nat (true)

Be aware that on 4.1 SP2 on Nokia, this can cause a system panic (4.1 SP3 or a hotfix resolve this problem). For more information about editing objects.C, see How do I edit objects.C or objects_5_0.C?

-- GuyR - 18 Jan 2004

FAQForm FAQs.Class: ServicesFAQs FAQs.OS: FAQs.Version: