I'm trying to setup Active Directory, I'm trying to move from macOS Server's Open Directory. It seems I can set the AD role succesfully as well as DHCP. The problem is as soon as I set up AD my the rest of my servers stop responding from outside using the
my subdomain linked to the network.
After days without sleeping I finally figured out the what was missing is hairpin NAT, I tried looking it up and the best I came with is NAT Routing and specifying yet again all the forwarding to my servers. For this I had to use two NICs because apparently
Routing doesn't work with only one as macOS Server does. For starters inputting the information was a nightmare and I couldn't even finish because the editor is this tiny window that doesn't let the user absorb much information, rule names cannot be reused,
TCP and UDP can't be join on one rule the port ranges cannot be input. This left my with a 1 thousand ports missing for VoIP and even if there was a workaround like command line or something, it should be easier, servers' job is to make things easier. These
are serious flaws in the OS I think.
Well, after not sleeping for four days and playing around with the DNS values on the DHCP scope, I noticed that if I input a public DHCP server it would resolve correctly my subdomain and load the internal websites from their local server using the FQDN
but computers won't be able to join Active Directory. I'm not removing the AD server's IP address from the list, I'm just not placing it at the top.
Screenshot: 1drv.ms/i/s!Aln_B1W1PHb4yB4ItpG5RLGUTsMj
(I can't post links nor images.)
On the other hand if I move up the Active Directory server's IP address to the top of the DHCP's DNS list my FQDN won't resolve from inside the network, even after setting up NAT Routing. I don't understand the point of having more than one DNS server on
the DHCP options if it will just use the first one anyway.
I tried also setting records at the DNS server role for my IP address but this turned out to be impossible as I don't have one IP address but four, I use a load balancer to connect to the internet, and to make matters worse, theses are not static IP addresses;
so in order to resolve my domain name my [external] DNS server at my registrar points the FQDN to 4 DDNS CNAMEs whose addresses are dynamically updated by the load balancer. It's a bit of a mess but it's been going strong for years now with no downtime.
I'm really hoping that out of sheer exhaustion I missed the setting or feature for hairpin NAT but seeing there's a loopback interface in the Routing and Remote Access console, my hopes are not very high.
I'm using Windows Server 2012 R2 Datacenter by the way. If I find a solution I'm going to stick Standard though, Datacenter's pricing is way to expensive and I didn't like WS2016's pricing model either.
Thanks for your help!