Windows Server with Active Domain; DNS related question

[yamahahornist]

So I have a Windows Server 2016 server setup running an active directory with a bunch of users and computers that are related to the small private school we run here. I have a custom linux dns server setup in VM that I use as a DNS forwarder to block access to websites and ads and such to all clients grabbing DNS from the server; which is all clients haha. But the issue I am having (its not really an issue, just was looking to do it better) is because clients grab DNS from the server's DNS all the DNS rules apply to the server it self. So for example; on my dns server I am blocking youtube.com*; on my server if I go to youtube its blocked aswell. Which with the way its currently setup makes complete sense. I am hope to be enlightened by another way though? The issue is all clients need there primary DNS to be set to the server to grab GPO and login info, etc. So I can't just directly push a custom DNS server to all clients through there DNS. I forward a DNS server through my windows server's DNS. Now obviously I don't need to watch YouTube on my server haha; but we are implementing a lot harder restrictions on the school; actually only allowing about 7 domains. Which would in turn also would effect my server; and I don't want those restrictions on the server.

Sorry that was a lot of info and I said DNS like a hundred times; but thanks in advance!

 

[13thmonkey]

can't you just specify a different dns in network settings, either on the server, or on a VM that you run for the purpose of not restricting yourself? come to think of it, can't the pupils? I suppose that's an active domain feature to supply the DNS address.

 

[yamahahornist]

can't you just specify a different dns in network settings, either on the server, or on a VM that you run for the purpose of not restricting yourself? come to think of it, can't the pupils? I suppose that's an active domain feature to supply the DNS address.

No I don't think I can; on my server the DNS points to itself (127.0.0.1). I tried changing it to 8.8.8.8 (google) and it wouldn't let me.

Actually I just changed it to 8.8.8.8 and 8.8.4.4 on the server; but the blocks are still going through? Maybe it needs a couple minutes to reset DNS?

 

[13thmonkey]

You need a machine 'outside' of the network, is this not what DMZ's are for?

 

[yamahahornist]

You need a machine 'outside' of the network, is this not what DMZ's are for?

Wouldn't google's DNS servers be a machine outside the network?

 

[13thmonkey]

The machine needs to be. You need more than I can give you. However we are bordering on topics we won't discuss, we don't actually know that you are the sysadmin, or that you are not trying to circumvent security put there by your employer and not you.

 

[yamahahornist]

The machine needs to be. You need more than I can give you. However we are bordering on topics we won't discuss, we don't actually know that you are the sysadmin, or that you are not trying to circumvent security put there by your employer and not you.

I totally understand; security is a priority. Thanks for the help; I found a different work around for now.