NAT and Guest User

[mxracer95]

Does NAT always use the Guest user account?

Also, what is the best way to setup the WinGate server to use WinGate for DNS without looping? The WinGate server machine has one static IP NIC and one dial-up modem.

My setup is: WinGate 6.1, Win Server 2003 w/AD. The server connects a small office network to the internet only as needed via dial-up, is used for file and printer sharing, AD user authentication, DNS, and DHCP (DNS & DHCP provided by WinGate - the Windows services have been disabled).

Thanks.

[Pascal]

Yes, it uses Guest. (In a way) NAT is a simple packet shuffler, much like a mail sorter in a post office that does redirection of mail. It has no understanding of the more complex protocols and as such has no way of authenticating.

However, authentication is not service based in WinGate - it's based on a machine. The services simply provide the methods to authenticate a given machine (IP) as a specific user.

Is the AD server on a different machine to WinGate? From the sound of it is. In that case, all that is necessary is to set the AD Server's IP as an unuseable DNS Server in the "Advanced Options" tool. (Found in WinGate's Start Menu). You can follow the rest of the steps in this knowledge base article which will explain all the steps required.

[mxracer95]

Everything is on one server - AD, Domain Controller, and Wingate.

That KB article you referred me to says the Wingate DNS and DHCP services should be disabled and the Windows DNS and DHCP services used. Is that all I need to do? What about the static IP settings of the nic?

[mxracer95]

Ok. Well what I really want is for Wingate to control the dial-up. It works better and is easier to control than Windows Routing and Remote Access' Dial on Demand.

What I thought I could do is assign a second IP address to the LAN nic, and have DNS forward all unresolved requests to that IP address, which Wingate would be listening on and would dial-out when it got the DNS request. However, Windows DNS will not let me assign a forwarding IP address if that IP address is on the same NIC that DNS is watching, even though DNS is set to only listen to the first IP address.

So my next thought was to not use DNS forwarding, but assign the 2nd IP address as a second DNS server address on the clients. That actually seems to be working, but I have more tests to do and running DCDIAG /TEST:DNS tells me my root hints are broken.