I have a problem with DNS resolving Azure machines from on-premise network connected with VPN to VMs' virtual network. In other cloud providers there are solutions to this problem, but I can't find one in Azure. In AWS I could create Inbound Route53 Endpoint which gives me IPs in the VPC that machines from my on-premise network can reach. In GCP there is forwarding DNS server policy. Is there any similar solutions in Azure ?
To resolve the DNS name of Azure VMs from an on-premise network, you need forward queries to your managed DNS proxy server in the corresponding virtual network, the proxy server forwards queries to Azure for resolution. The DNS servers in the virtual networks can forward DNS queries to the recursive resolvers (168.63.129.16) in Azure.
Note that Azure Private Zones does not help in this situation, you have to use your own DNS proxy server. Read here.
For more references:
Name resolution for resources in Azure virtual networks
Name resolution using your own DNS server
Related
I have the following situation:
If I deploy an application (Deployment, Service and Ingress) in my kubernetes cluster, my ingress deployment is being automatically added to my application gateway (I am using the Azure Application Gateway Ingress Controller; https://azure.github.io/application-gateway-kubernetes-ingress/annotations/ ). So far so good.
That means that my application can be reached via my application gateway via https://my-app-gateway-public-ip/myAppPath/. Also, I have an additional private DNS zone which makes my app accessible via https://dns-name/myAppPath.
Additionally, we have an AADDS in combination with a Bastion Service. Deployed some virtual machines and the virtual machines use the DNS resolver of the AADDS (for authentication against the AAD).
The problem is: If I am outside of the cloud, I can nslookup the dns or can access the site via the ip, but I cannot do that with my virtual machines. My DNS server (within the AADDS) is unable to resolve the dns or accessing the ip. I am wondering what the issue is.
The bastion and AADDS are in different subscriptions and therefore different virtual networks. I established already a peering between those virtual networks (or the authentication between the AADDS and the VMs wouldn't work).
The kubernetes cluster and the application gateway are also in a different subscription, but no peering has been done so far.
Are there any hints what I could be missing?
Kind regards
• Since, you are using a Bastion gateway server to connect to the VMs hosted in your subscription, the Bastion gateway server must be having a public IP address through which then the registered underlying VMs can be connected to via private links created in the private DNS zones associated with a particular virtual network in a subnet and an assigned private IP address and a FQDN accordingly. Thus, if you want to access the application website hosted behind the application gateway, then you will have to create a conditional forwarder in the DNS zone in AADDS to redirect the internal requests from the VMs hosted within a virtual network to the public IP address of the website hosted behind the application gateway
• Thus, a conditional forwarder forwards the DNS resolution requests for a particular resource hosted on the public internet for which the DNS host resolution is not found or done in that DNS zone which usually serves or fulfils the requests related to internal environment. As a result, when a VM configured with a private IP is registered as a host in the internal DNS zone queries the public IP or FQDN associated with the application’s website, the DNS requests are forwarded to the public internet through the conditional forwarder and then the results are displayed in the VM’s browser for the application’s webpage. Thus, the VMs don’t need to have internet access but the DNS server should have or should forward the requests through the Internet proxy server accordingly to reach the internet.
For more information on creating conditional forwarder in AADDS, kindly refer to the below link: -
https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-dns#create-conditional-forwarders
I have a Private AKS cluster deployed in a VNET on Azure. Once I deployed it, a private endpoint and a private DNS zone were created by default therefore making the cluster accessible from VM's which are part of the same VNET. (I have a VM deployed in the same VNET as the AKS cluster and "kubectl" commands work in it.)
My requirement is that I want to perform the "kubectl" commands from my local machine (connected to my home network) and also connected to the VPN which connects to the VNET.
My machine can talk to resources within the VNET but cannot seem to resolve the FQDN of the private cluster.
I read somewhere that having a DNS forwarder setup in the same VNET can help resolve the DNS queries made from the local machine which can then be resolved by Azure DNS. Is this the way to go about this? Or is there a better way to solve this problem?
It would really help if someone could give me an action plan to follow to solve this problem.
The better way to perform the "kubectl" commands from your local machine to your private AKS cluster is to use AKS Run Command (Preview). This feature allows you to remotely invoke commands in an AKS cluster through the AKS API. This feature provides an API that allows you to, for example, execute just-in-time commands from a remote laptop for a private cluster. Before using it, you need to enable the RunCommandPreview feature flag on your subscription and install aks-preview extension locally. However, there is a limitation that AKS-RunCommand does not work on clusters with AKS managed AAD and Private link enabled.
In this case, If you want to resolve the FQDN of the private cluster from your on-premise network, you could select to use either the hosts file locally(used for testing) or use your DNS forwarder to override the DNS resolution for a private link resource like this.
The DNS forwarder will be responsible for all the DNS queries via a server-level forwarder to the Azure-provided DNS 168.63.129.16.You can provision IaaS Windows VM with DNS role or Linux VM with bind configured as a DNS forwarder. This template shows how to create a DNS server that forwards queries to Azure's internal DNS servers for Linux VM. Refer to this for DNS forwarder on Windows VM.
If there is an internal DNS server in your on-premise network. The on-premises DNS solution needs to forward DNS traffic to Azure DNS via a conditional forwarder for your public DNS zones(e.g. {region}.azmk8s.io). The conditional forwarder references the DNS forwarder deployed in Azure. You could read this blog about DNS configuration sections for more details.
I want my virtual machines that takes place in a VPC network on GCP be able to resolve my on-premise network DNS server records like *.mycompany.com
Now I can't nslookup for a DNS like example.mycompany.com, to be able to do this in the Azure, there is a configuration that you can set your DNS server for a specific virtual network, after that all resources in that virtual network uses that DNS server. Is there any idea that what's the GCP equivalent for DNS settings for a specific network?
I need to do this on the GCP side. I followed this link on the GCP docs and tried to create private DNS zone for forwarding but tbh couldn't understand completely how it works. Because unlike Azure, it seems to a bit complicated to me.
Note: For both Azure and GCP there are VPN tunnels between on-premise network and cloud.
Thanks in advance.
The Google Cloud equivalent to Azure Custom DNS server is using a DNS Policy to enable an alternative name server.
gcloud dns policies create POLICY_NAME \
--description=DESCRIPTION \
--networks=VPC_NETWORK_LIST \
--alternative-name-servers=ALTERNATIVE_NAMESERVER_LIST
gcloud dns policies create
I recommend forwarding zones, but creating a policy might be easier for you to implement.
found this, for the DNS server policies: Applying Cloud DNS server policies
Would a VM on-premises connected to Azure through an S2S VPN tunnel be able to query Azure DNS (168.63.129.16) for Azure private zones, or would a custom DNS be required to forward the query?
Thanks!
In this case, you need a custom DNS proxy server to forward queries to Azure for DNS resolution.
Reference: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances
VM and App Service are located in the same Virtual Network.
App Service is added to VM through VNet Integration (preview)
VM is autoregistered in Private DNS zone, say by name myvm1. And full name myvm1.priv.zone
Private DNS zone is linked to Virtual Network.
Virtual Network - DNS Servers is set to default.
VM and App Service were restarted after configuration.
Problem is I can resolve neither myvm1 nor myvm1.priv.zone from App Service console by nameresolver.exe
UPDATE:
Actually, the issue is even bigger. App Service is not able to send requests to VMs in Virtual Network by their Private IPs (10.1.x.x) even if everything is allowed on VMs' subnet. If the same requests are sent to VMs' Public IPs there is no problem.
As the existing answer, for scenario Name resolution from App Service Web Apps to VMs in the same virtual network. in this DOC, you need to deploy your own DNS server to help name resolution.
Here are the steps:
On the Azure VM in the VNet, add a server role DNS server, after the installation, configure the DNS server, add Zone name such as qaz.lab in my example. You also can manually add an A record for your Azure VM in this Zone.
Add the DNS server private IP address in the custom DNS server of Azure VNet. Then restart the Azure VM to make it effective.
Configure VNet Integration with your app, in this case, select the new VNet integration. After that, refresh your VNet Integration. You will see the DNS server update in your app service plan --- networking.
Navigate your app service, run nameresolver FQDN to validate the DNS resolution. Currently, It only supports FQDN resolution.
Let me know if you have any question.
As of today, you need to use DNS proxies or forwarders to achieve your ask. It is documented here in the scenario table.
For scenario "Name resolution from App Service Web Apps to VMs in the same virtual network.", the solution is to "Customer-managed DNS servers forwarding queries between virtual networks for resolution by Azure (DNS proxy)."
On How to perform "Name resolution with your own DNS" check here, where your scenario is described.