I'm looking for a good way to secure my servers, I have a set of dedicated servers that are not in my office but hosted by an external provider. ALL the servers have only one public (WAN) IP.
I don't want to use VPN as my users are not willing to have this constraint, so I went to a Firewall configuration of my Windows Server (through a GPO) to enable IPSec in Domain Isolation.
Every server require a secure connection for in-bound, which from my point of view is pretty much secured.
But one thing bothers me, in order to make the default authentication mode (which involves Kerberos) work in my domain isolation I had to setup the firewall of my DNS/DC server with "Request inbound and outbound" (instead of the default "Required inbound and request outbound"). I guess it's necessary for the Kerberos authentication to work.
Again, from my understanding it leaves the DNS/DC server unprotected by IPCSec (though I don't exactly know what really is "request" as opposed to "required").
My first question is: is it safe enough ? Second question: how could I configure IPSec with the DNS/DC server as protected as the other servers?
Thanks for your time.