How Can I Create a Domain Trust Through a Firewall?

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

To create an Active Directory trust through a firewall, first establish private routing between the environments, configure bidirectional DNS, allow the required AD traffic between approved systems, create the trust in Active Directory Domains and Trusts, and then validate both the trust and a real resource-access scenario. A firewall permits the communication required by a trust; it does not create the trust itself.

Choose the right trust first

A trusted domain is the domain whose users may be authenticated. The trusting domain accepts those users and may grant them access to resources.

#	Preview	Product	Price
1		FortiGate-40F Firewall Appliance - 5 Gigabit Ethernet RJ45 Ports, Ideal for Small Businesses...	$357.55	Buy on Amazon
2		Firewall Appliance 10GbE Mini PC with SFP+, Intel Alder Lake N100 (4C/4T) 4xIntel I226-V 2.5GbE...	$345.00	Buy on Amazon
3		Netgate 1100 pfSense+ Security Gateway - Firewall, Router, VPN	$294.00	Buy on Amazon
4		VNOPN Fanless Firewall Appliance Intel J3710 4C/4T, Firewall Mini PC, 4 x Intel i226 LAN Ports,...	$259.00	Buy on Amazon
5		Firewall Mini PC, Intel J1900 4-Port i210 Router, 4GB RAM 64GB SSD	$219.99	Buy on Amazon

A one-way trust describes the direction of authentication—not the direction of network packets. A two-way trust allows both sides to authenticate users from the other side, but it still does not grant access to files, applications, or servers. Resource owners must assign share, NTFS, application, or other permissions separately.

A forest trust connects two AD DS forests and is transitive across domains in those forests, subject to name-suffix routing and security settings. An external trust is nontransitive and connects domains for narrower or legacy scenarios. Microsoft’s netdom trust documentation also makes an important distinction: netdom trust cannot create a forest trust between two AD DS forests.

#1 Best Overall

FortiGate-40F Firewall Appliance - 5 Gigabit Ethernet RJ45 Ports, Ideal for Small Businesses (Appliance Only, No Subscription) (FG-40F)

• Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
• Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
• High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
• Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
• Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.

$357.55

Buy on Amazon

What must be ready before changing the firewall?

• A functioning AD DS domain or forest exists on each side.
• The relevant domain controllers can be reached over a private routed connection or site-to-site VPN.
• IP ranges do not overlap, and routes exist in both directions where required.
• Each side can resolve the other side’s fully qualified domain names and AD service records.
• Time synchronization is correct. Kerberos authentication is sensitive to clock differences.
• Administrators have credentials and permissions to create or manage the trust.
• Network firewalls, VPN policies, and Windows Defender Firewall rules have all been considered.
• The participating domain controllers and, for later resource access, member or application servers are identified.

Keep the trust-creation path separate from the trust-usage path. Initially, domain controllers on both sides need to communicate. Later, a file server, application server, workstation, or other member computer may also need to contact the partner domain or a Global Catalog. A trust between domain controllers alone does not automatically make every member server work.

Configure DNS before creating the trust

DNS is one of the most common causes of failed trust creation. It is not enough for a single host record to resolve. Domain controllers must be able to locate the partner’s AD services, including LDAP and Kerberos through DNS SRV records.

Conditional forwarding is one practical design. On a DNS server in Forest A, forward queries for Forest B to Forest B’s DNS servers:

Add-DnsServerConditionalForwarderZone `
  -Name "partner.example.com" `
  -ReplicationScope "Forest" `
  -MasterServers 10.20.30.10,10.20.30.11

Configure the reverse direction on Forest B’s DNS infrastructure. The Microsoft DNS Server documentation describes the command and its AD-integrated replication options.

Run these checks from a domain controller or an approved administrative host in each forest:

Resolve-DnsName dc1.forestb.example
Resolve-DnsName _ldap._tcp.dc._msdcs.forestb.example
Resolve-DnsName _kerberos._tcp.forestb.example

Repeat the tests in the opposite direction using Forest A’s names. Test reverse lookup where your design depends on it. Also confirm that the domain controllers themselves use DNS servers capable of forwarding the queries; querying a partner DNS server manually does not fix an unsuitable DNS configuration on the domain controller.

Rank #2

Firewall Appliance 10GbE Mini PC with SFP+, Intel Alder Lake N100 (4C/4T) 4xIntel I226-V 2.5GbE 2*Intel 82599ES 10GbE Firewall LTE Router Support AES-NI (N150, NO RAM NO ROM) (N150, NO RAM NO ROM)

• 【Professional Firewall & NAS SERVER】OAKNODE 10gbe Firewall Appliance Mini PC-MGNASN, a powerful professional firewall router pc equipped with a 12th Gen Alder Lake N100 4C/4T up to 3.4GHz TDP only 6W with Intel UHD Graphics which maximizes the performance of the 2.5GbE port & SFP+ port, bring you a smooth secured and encrypted network environment.
• 【Rich I/O to meet your needs】Firewall Appliance MGNASN With HDMI 2.0+DP 1.4+TYPE-C(dp 1.2) Support for 3x4K@60Hz together, Dual DDR4 RAM slot support for up to 1x32GB SO-Dimm laptop DDR5 Ram Maximum 5600Mhz and 1xM.2 NVMe/PCIe 3.0x1 2280 SSD slot +1*SATA 3.0 SSD/HDD slots (install externally), also it support boot from TF card slot and it also support PXE/AWOL/Watchdog/GPIO etc. which is perfect for your firewall appliance、VM、Router、home Server needs.
• 【2xSFP+ 10GbE + 4x2.5GbE】This Firewall Router equipped with 2xIntel 82599ES 10gbe network card and 4*Intel i226-V network card speed maximum up to 2.5GbE(need other device like router, cables etc. also support 2.5Gbe/10gbe)which can bring you more faster and professional network usage(some system not release drivers yet) suggest to install version of below systems: pf-sense plus 23.0X or CE 2.7.X, OPNsense 22.1, OpenWrt, ROS7, ESXI 8 , Proxmox, CentOS etc).
• 【4G LTE Function supported】This model also support 4G LTE function(mini PCIE slot for 4G modem) and SIM card slot which you can use it as a IOT devices for your server.
• 【Quality With Warranty】If you have any questions or requirements(like OS installation/ drives/bios updates etc.) on OAKNODE Firewall mini pc MGNASN, PLEASE feel free to contact us. We offered 12 Months warranty for it and WE'LL REPLY YOUR Questions within 12 hours(during Workdays).

$345.00

Buy on Amazon

Firewall ports for a modern AD trust

There is no universal list that should be opened between entire corporate networks. Microsoft’s Active Directory firewall guidance notes that the exact requirements depend on the topology and services crossing the boundary.

Do not forget dynamic RPC

Opening TCP 135 alone is a classic incomplete fix. Port 135 lets a client locate an RPC service through the Endpoint Mapper. The RPC session normally continues on a dynamically assigned high port. For modern Windows Server systems, Microsoft documents TCP 49152–65535 for relevant AD trust traffic.

Reduce exposure by restricting source and destination addresses to approved domain controllers and, where supported by the specific service and design, controlling RPC ranges. Do not assume that every AD RPC dependency can safely be reduced to one arbitrary port. Microsoft’s Entra Domain Services forest-trust guidance specifically notes that AD DS does not support restricting all Active Directory RPC traffic to specific ports.

Design the firewall rules narrowly

1. Permit traffic only between the approved domain-controller IP addresses initially.
2. Separate DNS, authentication and directory, RPC, and optional management or replication rules.
3. Apply rules in every direction required by the trust and routing design.
4. Include host-based firewall policies on the domain controllers.
5. Log denied traffic while testing.
6. Temporarily widen a rule only to diagnose a documented dependency, then narrow it again.
7. Add specific member, file, or application servers only when the ongoing use case requires them.

Avoid an “any-to-any” rule between the two networks. Besides increasing risk, it hides which service is actually missing and makes future maintenance difficult.

Create a forest trust with Active Directory Domains and Trusts

For two ordinary on-premises AD DS forests, use the Active Directory Domains and Trusts console.

Rank #3

Netgate 1100 pfSense+ Security Gateway - Firewall, Router, VPN

• BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
• COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
• POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
• COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
• FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.

$294.00

Buy on Amazon

1. Sign in with an account authorized to create trusts.
2. Run domain.msc or open Active Directory Domains and Trusts from the administrative tools.
3. Right-click the forest root domain and select Properties.
4. Open the Trusts tab and select New Trust.
5. Enter the other forest’s fully qualified DNS name, such as forestb.example.com.
6. Select Forest Trust.
7. Choose One-way or Two-way.
8. Choose whether to create the trust on this side only or on both sides.
9. Provide the required credentials and a strong trust password when prompted.
10. Finish the wizard and validate the relationship from the Trusts tab.

Use a two-way trust only when both forests genuinely need mutual authentication. For a partner or merger environment where access should flow in one direction, a one-way trust usually provides a smaller and easier-to-review security boundary.

Do not use netdom trust as the primary method for creating a forest trust. Microsoft explicitly says it cannot create a forest trust between two AD DS forests. It remains useful for applicable domain or external trust operations, management, resetting a trust secret, and verification.

Create or manage an applicable domain trust with netdom

For a supported domain or external trust, the generalized command pattern is:

netdom trust <TrustingDomain> ^
  /domain:<TrustedDomain> ^
  /add ^
  /twoway ^
  /usero:<TrustingDomain><AdminUser> ^
  /passwordo:* ^
  /userd:<TrustedDomain><AdminUser> ^
  /passwordd:*

The prompts represented by * prevent passwords from being placed directly in the command line. Relevant options include /add, /remove, /twoway, /verify, /reset, and, where supported, /selectiveauth:Yes, /enableSIDHistory:Yes, and /foresttransitive:Yes. Check the current Microsoft syntax and supported scenarios before automating.

Secure the trust

Selective authentication

When partner users should reach only explicitly approved computers, use selective authentication where the trust type supports it. The trust can be healthy while logons still fail if foreign users or groups have not been granted Allowed to authenticate on each target computer.

This is particularly important across organizational boundaries. It changes authorization behavior and must be applied to every approved resource server, not just the domain controller.

Rank #4

VNOPN Fanless Firewall Appliance Intel J3710 4C/4T, Firewall Mini PC, 4 x Intel i226 LAN Ports, Network Gateway, Soft Router, Support PF-Sense/OPN-Sense, AES-NI (8GB RAM 128GB SSD)

• 【CPU】Intel Pentium J3710 4-Core/4-Thread processor, up to 2.64GHz, with 2MB L2 Cache and 6W TDP. Supports AES-NI and suitable for firewall, router, VPN and other network applications.
• 【Ports & Expansions】Equipped with 4 x 2.5GbE Intel i226-v LAN ports. Includes 2 x USB3.0, 1 x HDMI. 1 x VGA ports.Supports optional Wi-Fi and 3G/4G module expansion, plus a VESA mounting kit.
• 【Fanless & Low-Power Design】6W fanless design with an aluminum alloy chassis for quiet, low-maintenance operation. Design for 24/7 continuous use and suitable for home networks, small office and network labs.
• 【RAM & Storage】Includes 8G DDR3 RAM and a 128GB mSATA SSD. Supports up to 8GB RAM and 512GB mSATA storage. HDD storage is not supported. Compact 5.27 x 4.98 x 1.43-inch design weighs only apporximately 500g.
• 【Warranty & Support】Tested with pfSense, OPNsense, Ubuntu and other popular open-sourse OS. Supports Proxmox VE for virtualization and home lab applications. Includes a 12-month hardware warranty and lifetime technical support. (Press "DEL" to the BIOS)

$259.00

Buy on Amazon

SID filtering and SID history

SID history can help preserve access during a migration, but accepting it expands the trust boundary. Microsoft advises enabling SID history only when the administrators of the trusted forest are trusted. Do not disable SID filtering as a routine troubleshooting step. Any change should be part of a documented migration design and security review.

Name-suffix routing

Forest trusts route authentication using DNS name suffixes. Conflicting, missing, or disabled suffixes can cause confusing authentication failures. Review name-suffix routing when users resolve correctly but authentication is sent to the wrong forest or a particular namespace fails.

Validate the trust at several layers

Check DNS and selected ports

Resolve-DnsName forestb.example.com
Resolve-DnsName _ldap._tcp.dc._msdcs.forestb.example
Test-NetConnection dc1.forestb.example -Port 53
Test-NetConnection dc1.forestb.example -Port 88
Test-NetConnection dc1.forestb.example -Port 135
Test-NetConnection dc1.forestb.example -Port 389
Test-NetConnection dc1.forestb.example -Port 445

A successful TCP 135 test does not prove that dynamic RPC works. Use firewall logs and trust validation to confirm the complete RPC exchange.

Validate in the console

1. Open Active Directory Domains and Trusts.
2. Right-click the local domain and choose Properties.
3. Open Trusts, select the trust, and choose Properties.
4. Select Validate.
5. Validate one side or both sides as appropriate.

A successful validation should report that the outgoing trust has been validated and is in place and active.

Use nltest or netdom

nltest /sc_verify:forestb.example.com

For supported domain-trust scenarios, use:

netdom trust foresta.example.com ^
  /domain:forestb.example.com ^
  /verify ^
  /userd:FORESTBAdminUser ^
  /passwordd:* ^
  /usero:FORESTAAdminUser ^
  /passwordo:*

For Kerberos-specific verification, Microsoft documents adding the /kerberos option with credentials for both domains.

Test actual access

Create a controlled test group, grant it access to a test SMB share, and sign in or connect as a user from the other domain. Confirm that the resource server can resolve the foreign security principal and that access is removed when permissions are removed. Test both directions only when the trust is two-way.

Best Value

Firewall Mini PC, Intel J1900 4-Port i210 Router, 4GB RAM 64GB SSD

• 【CPU Optimized for Firewall Mini PCs】This firewall appliance is powered by Intel Quad-Core Celeron J1900, 64-bit, up to 2.0 GHz, supporting software-based encryption. Energy-efficient and reliable, it runs 24/7 for home or small office networks, handling VPNs, multi-WAN routing, and basic firewall tasks efficiently.
• 【4×Intel i210 Ports】Equipped with four Intel i210 network controllers, each delivering up to 1 GbE for reliable multi-WAN routing, VPN connections, VLAN management, and stable performance in small office or home firewall deployments
• 【Memory & Storage】This Firewall Mini PC comes with 4 GB DDR3L RAM and a 64 GB mSATA SSD, providing reliable performance for basic networking tasks. AMI BIOS with ACPI support ensures stable system operation and energy-efficient 24/7 use
• 【Flexible System Compatibility】Compatible with Windows 10, Linux, and professional firewall systems such as pfSense, OPNsense, and VyOS, ensuring stable network management for home or small office use
• 【After-Sales Support:】This compact, fanless, and silent firewall keeps your network secure. Includes lifetime technical support and a 30-day money-back guarantee!

$219.99

Buy on Amazon

A successful trust validation does not prove that share permissions, NTFS permissions, selective authentication, SID filtering, Global Catalog access, or application authentication are correctly configured.

Troubleshoot by symptom

The wizard cannot continue or cannot contact the domain

1. Resolve the partner FQDN from both sides.
2. Resolve _ldap._tcp.dc._msdcs.<domain>.
3. Check TCP/UDP 53.
4. Check TCP 135 and the dynamic RPC range.
5. Confirm the selected domain controllers are reachable through the private route.
6. Verify credentials and trust-creation rights.
7. Check domain names versus NetBIOS names.
8. Inspect the domain controller’s host firewall.

DNS works, but the trust fails

Check whether SRV records resolve, whether forwarding works in both directions, whether all domain controllers use the intended DNS servers, and whether a stale or conflicting zone returns an unsuitable server address.

TCP 135 works, but RPC fails

This is usually a dynamic-RPC problem. Review denies for TCP 49152–65535 on modern systems, confirm the rule applies in the correct direction, and verify that both perimeter and host firewalls permit the traffic.

The trust validates, but a share cannot be accessed

Check share and NTFS permissions, group membership, resource-server DNS, trust direction, selective authentication, SID filtering or SID history, and whether the server can contact a suitable domain controller or Global Catalog.

Kerberos fails while name resolution works

Check time synchronization, SPNs, DNS canonical names, TCP/UDP 88, application support for cross-forest Kerberos, and whether the client is falling back to NTLM.

Only some users or groups appear

Investigate Global Catalog access on TCP 3268 or 3269 where required, selective authentication, name-suffix routing, and the ability of the searching server to contact the partner directory.

The trust breaks after a domain-controller change

Rules tied to individual DC addresses can fail after maintenance or site changes. Maintain a documented list of permitted controllers, update rules when DCs change, use AD Sites and Services and DNS correctly, and monitor firewall denies and trust-health events.

Quick Recap

Bestseller No. 1

FortiGate-40F Firewall Appliance - 5 Gigabit Ethernet RJ45 Ports, Ideal for Small Businesses (Appliance Only, No Subscription) (FG-40F)

$357.55

Bestseller No. 2

Firewall Appliance 10GbE Mini PC with SFP+, Intel Alder Lake N100 (4C/4T) 4xIntel I226-V 2.5GbE 2*Intel 82599ES 10GbE Firewall LTE Router Support AES-NI (N150, NO RAM NO ROM) (N150, NO RAM NO ROM)

$345.00

Bestseller No. 3

Netgate 1100 pfSense+ Security Gateway - Firewall, Router, VPN

Ideal for AI security: Protect your AI workloads and data.

$294.00

Bestseller No. 4

VNOPN Fanless Firewall Appliance Intel J3710 4C/4T, Firewall Mini PC, 4 x Intel i226 LAN Ports, Network Gateway, Soft Router, Support PF-Sense/OPN-Sense, AES-NI (8GB RAM 128GB SSD)

$259.00

Bestseller No. 5

Firewall Mini PC, Intel J1900 4-Port i210 Router, 4GB RAM 64GB SSD

$219.99

Production checklist

• Confirm the required trust type and direction.
• Identify participating domain controllers and resource servers.
• Establish private routing or a site-to-site VPN with non-overlapping routes.
• Configure deliberate, bidirectional DNS forwarding or an equivalent design.
• Verify A, reverse, and AD SRV records.
• Permit only the necessary traffic between approved systems.
• Include TCP 135 and modern dynamic RPC, not just well-known AD ports.
• Account for Windows host firewalls.
• Create forest trusts through Active Directory Domains and Trusts.
• Use netdom only for applicable trust types, management, reset, or verification.
• Validate from both sides.
• Test a real cross-domain resource and confirm permissions behave as intended.
• Use selective authentication for narrowly scoped partner access where appropriate.
• Review SID history and SID filtering as explicit security decisions.
• Document DC addresses, ports, DNS design, trust direction, and recovery steps.
• Monitor authentication failures, firewall denies, and domain-controller changes.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.