Hosting Multiple Websites on Windows 2003 Server w/ IIS6

  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post July 29th, 2009, 12:02 pm

I saw the masking option when I looked earlier today. It still doesn't address the email issue though. Doing it the way I want to though would as I can set up MX records which I don't see the option to do at godaddy. And I need mail to be domain specific for these.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • Anonymous
  • Bot
  • No Avatar
  • Joined: 25 Feb 2008
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post July 29th, 2009, 12:02 pm

  • mindfullsilence
  • Professor
  • Professor
  • User avatar
  • Joined: Aug 04, 2008
  • Posts: 846
  • Status: Offline

Post July 29th, 2009, 1:53 pm

heh, again, over my head. I'll get TOOL back in here to see if he knows what's up. Hopefully he'll be able to answer tonight
Use your words like arrows to shoot toward your goal.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post July 29th, 2009, 3:38 pm

Well primarily right now, I think I have everything I need set up correctly as far as name servers go. I think the problem now is getting the DNS queries through my Cisco Firewall to query my internal DNS server.

I really don't want to go with a forwarding option. I had a friend tell me the port I needed to open for DNS (I think it was port 53 TCP and UDP if I recall correctly) and I'm pretty positive I opened it correctly (I'm not a Cisco expert - my firewall was originally configured by an external company and I've been learning on the fly). I think the main issue now comes down to NAT translation which I'm not at all familiar with.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • TOOL_5150
  • Born
  • Born
  • User avatar
  • Joined: Jul 28, 2009
  • Posts: 3
  • Status: Offline

Post July 29th, 2009, 11:47 pm

Email issue:

To Create an MX Record
Log in to your Account Manager.
In the My Products section, click Domain Manager.
Click the domain name for which you want to create an MX record.
In the Total DNS Control section, click Total DNS Control and MX Records.
Click Add New MX Record.
Complete the following:
Priority
The priority with which you want to assign the mail server.
Host Name
The domain name for the MX record. You can enter @ to map the record directly to your domain, or enter the subdomain of your host name (for example, www, ftp, and so on).
Enter Goes To Address
The mail server's address.
TTL
The time increment for which the server should cache the information.
Click OK.


~Matt
  • TOOL_5150
  • Born
  • Born
  • User avatar
  • Joined: Jul 28, 2009
  • Posts: 3
  • Status: Offline

Post July 30th, 2009, 12:00 am

To Set the Nameservers for Your Domain
Log in to your Account Manager.
In the My Products section, select Domain Manager.
Use the checkbox(es) to select the domain name(s) you want to modify.
Click Nameservers.
Select: Parked/Forwarding Nameservers
Click OK.
If an offer displays and you want to accept it select the option and click Add to Cart; otherwise click No Thanks, Set Nameservers.


To Forward a Domain
Log in to your Account Manager.
In the My Products section, click Domain Manager.
Use the checkbox(es) to select the domain name(s) you want to modify.
Click Forward.
Select Enable forwarding.
In the Forward to field, enter the URL to which you want to forward your domain name(s).
In the Redirect type area, select:
301 Moved Permanently
Redirects to the site you specified in the Forward To field using a "301 Moved Permanently" HTTP response. The HTTP 301 response code tells user-agents (including search engines) that the location has permanently moved.

Go to the Masking tab.
Select Enable masking, and then enter the following:
Masked title
A short title that describes your Web site, up to 80 characters.
Masked description Meta tag
A short description about your Web site, up to 150 characters.
Masked keyword Meta tag
Keywords that describe your page, separated by commas or spaces, up to 500 characters. Search engines use keywords to identify the content on your Web site.
Click OK.

NOTE: Forwarded domains can take up to 24-48 hours to become active.




---------


This info was taken from godaddy help. I personally hate godaddy, but to each his own. I would not recommend you using YOUR dns servers for DNS lookups - let godaddy take care of that for you with URL forwarding.

As far as the email issue, add an MX record [basically an ip] that points to the email server that handles the emails for that specific domain name, and you should be good to go.

~Matt
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post July 30th, 2009, 7:45 am

Thanks for the help TOOL. Forwarding and masking are out. I did it for one of my sites and it worked just fine as I expected, but every page displays the home page link. I can't have it like that. I have to do it the way I had planned from the start, but looking around the manager there, I have a couple ideas.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • dyfrin
  • Proficient
  • Proficient
  • User avatar
  • Joined: May 10, 2006
  • Posts: 499
  • Loc: WI
  • Status: Offline

Post August 6th, 2009, 10:54 am

Ok ATNO/TW,

Correct me if I am wrong on the Scenario.

Scenario
Quote:
2 domain names that do not have an associated DNS Server (Godaddy only has the name, you need to point it to an authorized DNS Server that has the addresses and the IP's on it)
1 domain name that is on the ISP DNS server that points to your static IP.

1 IIS/DNS Server on LAN
1 Cisco Pix on LAN/WAN that has 1 external address assigned to it.



Resolution

DNS

First and formost, you cannot, cannot, have the lan domain be the same domain as one of the websites. Are you running Active Directory or are the machines in a Workgroup?

Second, the tricky aspect of local LAN clients using that DNS server.
If you go to http://www.domain1.com, your DNS will be set to return 216.external.number.44 to make external people get the right address, and your local client will never resolve the address because of NAT. It would need the local 172.16.1.20 address instead of the external for communication to the server on the LAN.

I propose not using this DNS for local at all, and making another DNS server for local.

So on your existing DNS server that will be used for EXTERNAL connections, open DNS and go New forward lookup zone.
domain1.com
domain2.com
domain3.com

In each, you put www. and BLANK A records to point to the external address of the PIX. *under assumption you have 1 ip address*

PIX

As of PIX 6.2 use static route. Insert actual values wherever you see my <example> without the < >.

Code: [ Select ]
static (inside, outside) tcp interface 53 <dnsserverip> 53 netmask 255.255.255.255 0 0
static (inside, outside) udp interface 53 <dnsserverip> 53 netmask 255.255.255.255 0 0
 
static (inside, outside) tcp interface 25 <mailserverip> 25 netmask 255.255.255.255 0 0
 
static (inside, outside) tcp interface 80 <webserverip> 80 netmask 255.255.255.255 0 0
static (inside, outside) tcp interface 443 <webserverip> 443 netmask 255.255.255.255 0 0
 
conduit permit tcp any eq 53 <dnsserverip>
conduit permit udp any eq 53 <dnsserverip>
 
conduit permit tcp any eq 25 <mailserverip>
 
conduit permit tcp any eq 80 <webserverip>
conduit permit tcp any eq 443 <webserverip>
 
  1. static (inside, outside) tcp interface 53 <dnsserverip> 53 netmask 255.255.255.255 0 0
  2. static (inside, outside) udp interface 53 <dnsserverip> 53 netmask 255.255.255.255 0 0
  3.  
  4. static (inside, outside) tcp interface 25 <mailserverip> 25 netmask 255.255.255.255 0 0
  5.  
  6. static (inside, outside) tcp interface 80 <webserverip> 80 netmask 255.255.255.255 0 0
  7. static (inside, outside) tcp interface 443 <webserverip> 443 netmask 255.255.255.255 0 0
  8.  
  9. conduit permit tcp any eq 53 <dnsserverip>
  10. conduit permit udp any eq 53 <dnsserverip>
  11.  
  12. conduit permit tcp any eq 25 <mailserverip>
  13.  
  14. conduit permit tcp any eq 80 <webserverip>
  15. conduit permit tcp any eq 443 <webserverip>
  16.  


For you, the dns mail and webserver ip are the same in the scenario.

Using ASDM then you create firewall rules to allow any to the two servers for those ports.

IIS
Now for IIS you need to create the 3 sites, all as 80/443, but different directories with different HOST HEADER VALUES.

You can test this internally easily, by using the INTERNAL DNS server you made, and having the 3 forward lookup zones point to the same webserver.

GoDaddy

Point all domains to use the DNS server of OUTSIDE PIX Address
  • dzumwalt
  • Newbie
  • Newbie
  • No Avatar
  • Joined: Aug 13, 2009
  • Posts: 8
  • Status: Offline

Post August 13th, 2009, 7:03 am

On the question of running multiple websites. All you have to do after you do your forwarding (to your IP) from the place you got the domain is create the sites in IIS but make sure they all use different ports. If all your domains are using the same port is wont work. Make sure they all have different port numbers and that should work for you. I ran into the same thing setting up my web server.

Thanks,
D
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post August 13th, 2009, 7:14 am

dzumwalt that actually sounds like what I need to do. Can you give me a few more details with perhaps some examples? I'm not very good with firewalls and opening ports, but think I've finally figured out enough Cisco commands to be functional. Obviously I'm a total noob at this aspect. I'm having a hard enough time following what everyone is suggesting.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • dzumwalt
  • Newbie
  • Newbie
  • No Avatar
  • Joined: Aug 13, 2009
  • Posts: 8
  • Status: Offline

Post August 13th, 2009, 7:25 am

Do you have the domains set up on your server with different ports?
  • dzumwalt
  • Newbie
  • Newbie
  • No Avatar
  • Joined: Aug 13, 2009
  • Posts: 8
  • Status: Offline

Post August 13th, 2009, 7:26 am

you will just need to allow those ports in your ACLs
  • dzumwalt
  • Newbie
  • Newbie
  • No Avatar
  • Joined: Aug 13, 2009
  • Posts: 8
  • Status: Offline

Post August 13th, 2009, 7:28 am

Which should already be open because you are getting to the outside now right? As far as the commands, it has been 2 years since I have touched my firewall and I would have to do some more research.
  • dyfrin
  • Proficient
  • Proficient
  • User avatar
  • Joined: May 10, 2006
  • Posts: 499
  • Loc: WI
  • Status: Offline

Post August 13th, 2009, 7:30 am

The problem with ports is the DNS server does nothing to determine ports. It is only for name <-> ip conversion.

The port forwarding either happens on a router or on the webserver.
Hostname headers makes it so you don't need to differentiate ports.

AFAIK the pix does not do port forwarding based on destination NAME only by destination IP. Because both are on one server, you cannot go that route.

If you go with ports, who will know to type domain2.com:8084 or domain3.com:8085.

And on my previous post, I forgot that instead of a 2nd dns server, just modify system32/drivers/etc/hosts to manually force those 3 domains to the local IP on any workstation on that LAN.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post August 13th, 2009, 7:37 am

No, I don't believe so. I have the multiple websites set up in IIS per these instructions.
http://www.no-ip.com/support/guides/web ... g_iis.html

My default domain (wwwroot) is my company website and I can't change that. Let's call it http://www.mydomain.com My external IP address is static and mydomain.com is registered through Netsol. My A and MX and cname records point to Netsol's DNS servers with my static IP addy.

My webserver is also my DC and DNS server. In DNS I set up A records for NS1 and NS2 to resolve ns1.mydomain.com and ns2.mydomain.com to my internal DNS server. (I also created the same A records at Netsol).

Per a fellow admin's suggestion I opened port 53 TCP and UDP on my firewall to allow DNS queries.

At Godaddy where my "extra" domains are registered, I pointed them to ns1.mydomain.com and ns2.mydomain.com.

They still don't resolve. I followed the domain forwarding instructions earlier in this post, and that works fine, but the domain masking sucks as it keeps the primary domain in the address bar for all pages, which just simply isn't going to work for me.

I sort of follow what you're saying about being on different ports, but don't know how to do it.


Basically, I want my extra domains at godaddy e.g. mydomain2.com, mydomain3.com etc, to point to my static IP and resolve to the respective website in IIS. And that's where I'm stuck. Can't get them to resolve.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post August 13th, 2009, 7:39 am

dyfrin wrote:
If you go with ports, who will know to type domain2.com:8084 or domain3.com:8085.


Yes. That is exactly what I don't want.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • Anonymous
  • Bot
  • No Avatar
  • Joined: 25 Feb 2008
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post August 13th, 2009, 7:39 am

Post Information

  • Total Posts in this topic: 36 posts
  • Users browsing this forum: No registered users and 40 guests
  • You cannot post new topics in this forum
  • You cannot reply to topics in this forum
  • You cannot edit your posts in this forum
  • You cannot delete your posts in this forum
  • You cannot post attachments in this forum
 
 

© 2011 Unmelted, LLC. Ozzu® is a registered trademark of Unmelted, LLC.