I have configured my Azure Web Apps and App Hosting Plan to connect via Point-to-Site gateway with my Virtual Network in Azure. I followed this article here:
https://azure.microsoft.com/en-us/documentation/articles/web-sites-integrate-with-vnet/
I have a VM that is hosting DNS and my Virtual Network is configured to use this.
I want to be able to reference services running in my Virtual Network from my Web Apps via domain name and not by direct IP address.
It works fine if I connect using the VM's internal IP address eg 192.168.1.4. But, when I add a DNS A record pointing my-service.my-vnet.local to 192.168.1.4, my web app can't resolve the domain.
I attempted to check the DNS settings of the web app and it appears my internal DNS server is not one of the hosts configured. Here's the code I ran in my web app:
from nic in NetworkInterface.GetAllNetworkInterfaces()
let props = nic.GetIPProperties()
select String.Join("; ", props.DnsAddresses.Select(x => x.ToString()))
Is this possible to do? If so, can anyone suggest what I need to do?
From everything we have tried and talking with Azure folks at Ignite, Web Apps (point-to-site) were not designed to be joined to a domain. That said, we are successfully using web apps to access on-premise web services using a binding with a fully qualified domain name (FQDN) and securing that traffic be certificate.
Due to the way web apps connected to a VNET works, you will not be seeing the DNS servers when you list all interfaces. If in command line you run the command:
SET WEBSITE_
You should see an environment variable that holds your configured DNS servers. If not, you should go to your web app in the Azure Portal, to the Vnet section, and hit the "Sync Data" button.
Related
vnet is connected to my Web App through which I can communicate with other services and applications. When I specify the internal IP of another application to my application, everything works fine. But now the task has come from the management to remake it to use the internal DNS server and internal DNS names. In Azure vnet, in the DNS servers settings, I specified the IP of my DNS servers. I added 168.63.129.16 - now work. If you connect Windows VM to the network everything works fine. Perhaps something needs to be added to the Dockerfile or Linux Container Web App settings so that integration with vnet and DNS works.
If your web application is integrated with the virtual network, your application would be able to communicate with the applications in the virtual network
After integrating your web application with the virtual network, you need to perform sync network action
Go to Azure portal --> Go to your App Service plan where the web app is hosted --> Under Networking, select Virtual Network Integration --> select Sync Network
Once the sync action is complete, you would be able to communicate with your internal application using the DNS name from your web application
Reference: Name resolution for resources in Azure virtual networks | Microsoft Docs
Is it possible to enable apps within an internal ASE to automatically resolve the names of other apps within the ASE?
The ASE is configured to use the default domain (i.e. myase.appserviceenvironment.net) with Azure’s DNS resolution.
Reading the documentation on name resolution (https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances#azure-provided-name-resolution) I thought this would work out of the box. However trying this myself I’m not seeing automatic resolution. I’ve tried with FQDN, hostname, and hostname.asename all are not resolving.
The setup is an ASEv2 with a Function App talking to a regular App Service. Both are deployed on Linux using Docker images.
Since the DNS within ILB ASE is not managed by Azure, you must deploy your own DNS to enable name resolution between apps and VMs in the ASE VNet. See DNS configuration and this.
In this case, you might deploy a custom DNS server and change it to the DNS server of the VNet, then you will need to reboot your ASE.
I'm migrating asp.net services that used to exist on a physical server on-premise to Azure. However they need to reach some web-services (SOAP) that will not be migrated to azure yet. These have a public IP but I need to set the hostname in order for IIS to properly redirect the requests to the correct service as there are several on the same server. Is there any way to create some sort of DNS-server in azure that is only available for the services created in azure that can resolve to the public IP-address outside of azure? (We have used the hosts file on the servers to achieve this previously)
I tried using the private DNS Zones, but as I've understood it they can only point to other azure services within the same vnet (correct me if I'm wrong). I've also tried creating a dnsmasq docker container. However, as this is running in a Linux container, it seems that I cannot put it in the same vnet as the asp.net app services. Thus I am unable to retrieve a private IP-address that these services can use to reach the DNS server.
In my understanding it is now possible to use Azure DNS Private Zones if you want.
You would need to use regional vnet integration to point your app's traffic to a vnet that is connected to the Private Zone. You need the following settings as well, which mean that all outbound traffic from the Web App is routed through the integrated vnet first, and that the Azure default DNS server is used for DNS.
WEBSITE_DNS_SERVER with value 168.63.129.16
WEBSITE_VNET_ROUTE_ALL with value 1
https://learn.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet#azure-dns-private-zones
If you don't want to use Azure DNS Private Zones, I think you can achieve similar results by directing the Web App to use a specific DNS server. This can be done using WEBSITE_DNS_SERVER and WEBSITE_DNS_ALT_SERVER app settings (the values are the IP addresses of the servers you want to use).
This is the most authoritative public statement I can find about using these settings.
Go to the web app->settings->Application Settings-> App Settings
section
Add the following: (WEBSITE_NODE_DEFAULT) should already be
there.
a. WEBSITE_DNS_SERVER with value having the IP address of the
primary DNS server.
b. WEBSITE_ALT_DNS_SERVER (optional), with value
having the IP address of a second DNS server.
Then save the settings & restart webapp in portal.
Double check the web app can actually
connect to the DNS server: a. In kudu console, run: Nameresolver.exe
[hostname-to-lookup] [dns-server-to-use]
First argument should be the
hostname you are trying to look up, second argument is one of the DNS
servers from step 1) If this times out, there is an issue with how
your DNS servers are configured (firewalls, etc.)
https://github.com/MicrosoftDocs/azure-docs/issues/13927#issuecomment-416382230
If using these settings with a DNS server that is only accessible via private IP, you would need to use regional vnet integration again to connect to a vnet. If the DNS server is on-prem, you have to connect through the integrated vnet over VPN or ExpressRoute.
It's possible but not using the private DNS Zone.
According to Name resolution for resources in Azure virtual networks. For the scenario Name resolution from App Service Web Apps in one virtual network to VMs in a different virtual network, you need to use your own DNS servers forwarding queries between virtual networks for resolution by Azure (DNS proxy). See Name resolution using your own DNS server.
In this case, you only allow this azure web service could resolve the public IP address outside of Azure. You could enable virtual network integration for your web app, this restricts your web app access in a private network. Then you could deploy a DNS server in the same Vnet as the web app integrated VNet. You could create an A type record in your DNS zone to point to your service Public IP, then add the DNS server's IP address into the DNS server of the Integrated web app Vnet in the portal. If so, the web app could resolve this public IP via a custom DNS server.
Hope this could help you.
I deployed a Asp.Net Core 2 application to Azure, using Visual Studio Community's Publish feature. The non-database-dependent parts of the application function, but the database-specific code returns an error.
The application's database is a Sql Server instance installed on a Windows server hosted on a Azure VM (not an Azure SQL database).
To fix this, I:
determined the application's IP address using the Url property (xxx.azurewebsites.net) of the app's blade
added an inbound rule to the network security group's blade that allows all ports from this IP address
added an entry to the VM's Windows firewall to allow ports from this IP address
Unfortunately, this did not solve the problem. What am I missing?
Incidentally, what's the recommended way to set the ASPNETCORE_ENVIRONMENT to development when publishing to Azure (to enable more-detailed error messages)?
I am assuming that your web application is deployed to an Azure Web App. You may not have the correct outbound IP address for your VM hosting. Note that a Web App's inbound IP address may be different from the Web App's outbound address. To find the outbound addresses for your Web App, do the following:
Go to your Web App's management blade.
Choose the Properties menu item (under Settings). On this screen, there's a list of possible outbound IP addresses. Try whitelisting them all in your VM's firewall.
I've just set up a windows azure VM and installed IIS on it.
When I remote desktop onto the box I can see the default IIS website fine but I can't get this to serve on the web from the IP address of the box.
I've opened up port 80 on windows firewall and also added an endpoint for port 80.
I've tried to access it with the firewall completely turned off also but to no avail...
I cant work out if there is anything else I need to do to get this working?
Add endpoints for port 80 (http) and port 443 (https) to the VM in the Azure portal (tip: this can be automated with powershell or the Azure cli).
Remote desktop to the machine. Open the Windows firewall control panel and allow traffic to port 80 (http) and port 443 (https) or just turn it off ... the firewall is ON by default (tip: can also be scripted through the VM agent / powershell).
Go to the Azure portal and find the cloudapp.net subdomain for your VM (actually the cloud service) your VM is running under. Try accessing the site with that domain. If that doesn't work, try browsing to http://localhost on the server (remote desktop) to make sure IIS works and troubleshoot from there.
Modify the DNS records of your custom domain to use a CNAME to the .cloudapp.net domain. If you need A records make sure to use the public IP of the cloud service (just ping the .cloudapp.net domain to find it or look in the Azure portal).
You might want to look into Azure Websites or Azure Cloud Services (web roles). Those are a lot easier to manage and a lot cheaper. They still offer most of the functionality.
What fixed the issue for me was to go into the Azure Portal, browse to 'Network Security Groups', select the VM and then create an inbound rule to allow traffic to port 80.
Note: Also ensure that the inbound rule to port 80 is added and enabled on the actual VM.
Well, I deleted the existing VM and Cloud service and started again - all worked fine out of the box this time.
How annoying! The only thing I did notice was that before my cloud service had the same name as my VM - this time they had different names so that might have been what was causing the issue.
Cheers
For the newer VMs and pre-configured setups (2015+), it's possible your setup is using an azure asset called "Public IP". If so, you can set a custom DNS name label in it, inside "Configuration". Note that this name will consider any type of region used when creating the VM (e.g. my-site.brazilsouth.cloudapp.azure.com).
It's good to remember that for testing purposes, it still suffices to use the value of the public IP that is randomly designated to you.
The VMs are actually accessed via a Cloud Service (well they are for me). Azure created a Cloud Service automatically to be the scaling engine/load balancer on the front of the VM. I have to connect to the web site via that cloud service, not the VM directly.
Its possible you were using the internal IP rather than the external IP.
The sites have to use the internal IP address in the bindings section of IIS. However, in your dns you will need to use the external IP. This is presumably since the 'internal IP' is just a virtual one that Azure uses to map traffic from the external network to the VM's inside azure.
You should find both the internal and external IP's are visible on the VM's desktop.
Switch off TLS 1.3 in the Registry Editor.
This is what worked for me as of writing this in Mar 2021.