Azure recently introduced PIP - Public IPs that can be assigned to Virtual Machine instances, however it appears that there is no way to assign a PTR record to that IP so that a reverse DNS lookup will be successful. Here are the instructions to assign a PIP to an Azure VM:
https://azure.microsoft.com/documentation/articles/virtual-networks-instance-level-public-ip/
We have VMs on Rackspace Cloud running SMTP services that I'm trying to duplicate on Azure, but there appears to be no way to assign a PTR record for your Azure PIP. As a result, we are unable to provide our own SMTP service on Azure. Rackspace Cloud assigns a public IP address, and allows you to edit their DNS PTR records for that IP address and assign it to your service. Is there any way to do something similar with Azure?
BTW: SendGrid and Amazon SES are not an option. We've been running E-mail servers for decades responsibly, unless we can get a VM with a public IP and DNS setup properly, Azure isn't a viable option.
Now to the good news: I just learned that this is something they are actually working on right now!
Have a look here http://feedback.azure.com/forums/217313-networking-dns-traffic-manager-vpn-vnet/suggestions/3090834-provide-reverse-dns-ptr-records-for-virtual-mach
Announcing: Reverse DNS for Azure Cloud Services
http://azure.microsoft.com/blog/2014/07/21/announcing-reverse-dns-for-azure-cloud-services/
Enjoy....
Yes, but the outgoing IP is different then the VIP one for which you create the reverse unfortunately
The name resolution service provided by Azure is mainly designed to access virtual machines and role instances within a cloud service by hostname directly.
To access your public endpoints by name in this case, I recommend deploying your own (using your existing) DNS server(s) with all the flexibility it offers for creating A, MX, PTR etc. records.
For more information on name resolution scenarios, please review https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-name-resolution-for-vms-and-role-instances/.
Related
I have a question about Cloud DNS or Cloud VPN i don't know which is exactly related with my issue. I have a on-premise network and i have an internal dns for this network which is example.int. I've connected via Cloud VPN this on-premise network with a Cloud VPC in my Google Cloud account.
Both of my resources can access each other correctly but my VM's in Google Cloud vpc does not resolve my dns servers in my on-premise network. For example i can access my on-premise server via it's ip adress from Google Cloud VM but i cannot access it via on-premise-vm-1.example.int domain.
If i use my on-premise dns nameservers in resolve.conf i can access on-premise server but in that case .c..internal dns adresses do not work in my vpc. I want to use both of them.
What should i do you think? I could not find any working documentation for it. I want to resolve my on-premise and google cloud internal dns zones from my gcloud vms. Is there any way to do it without making any change on resolve.conf file in my all servers?
Thanks in advance
I try to change Cloud DNS server policies but when i try to change alternate dns servers in there, i cannot access my .internal dnsses due to metadata server. However, i cannot even access my example.int dnsses.
I also try to adding example.int dns into Cloud VPC as private dns zone. It also did not work.
In this case I would recommend to use GCP Cloud DNS private forwarding and point your desired on-prem internal DNS name to your on-prem DNS server.
Be aware that the requests will be coming from 35.199.192.0/19, son in your VPN you should include this range to be reached from your GCP project.
A workaround might be to manually create an internal Cloud DNS zone on your GCP project and manually update your DNS registries there too, the downside about this is that any change you want to make you should make it on both sides.
I'm migrating asp.net services that used to exist on a physical server on-premise to Azure. However they need to reach some web-services (SOAP) that will not be migrated to azure yet. These have a public IP but I need to set the hostname in order for IIS to properly redirect the requests to the correct service as there are several on the same server. Is there any way to create some sort of DNS-server in azure that is only available for the services created in azure that can resolve to the public IP-address outside of azure? (We have used the hosts file on the servers to achieve this previously)
I tried using the private DNS Zones, but as I've understood it they can only point to other azure services within the same vnet (correct me if I'm wrong). I've also tried creating a dnsmasq docker container. However, as this is running in a Linux container, it seems that I cannot put it in the same vnet as the asp.net app services. Thus I am unable to retrieve a private IP-address that these services can use to reach the DNS server.
In my understanding it is now possible to use Azure DNS Private Zones if you want.
You would need to use regional vnet integration to point your app's traffic to a vnet that is connected to the Private Zone. You need the following settings as well, which mean that all outbound traffic from the Web App is routed through the integrated vnet first, and that the Azure default DNS server is used for DNS.
WEBSITE_DNS_SERVER with value 168.63.129.16
WEBSITE_VNET_ROUTE_ALL with value 1
https://learn.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet#azure-dns-private-zones
If you don't want to use Azure DNS Private Zones, I think you can achieve similar results by directing the Web App to use a specific DNS server. This can be done using WEBSITE_DNS_SERVER and WEBSITE_DNS_ALT_SERVER app settings (the values are the IP addresses of the servers you want to use).
This is the most authoritative public statement I can find about using these settings.
Go to the web app->settings->Application Settings-> App Settings
section
Add the following: (WEBSITE_NODE_DEFAULT) should already be
there.
a. WEBSITE_DNS_SERVER with value having the IP address of the
primary DNS server.
b. WEBSITE_ALT_DNS_SERVER (optional), with value
having the IP address of a second DNS server.
Then save the settings & restart webapp in portal.
Double check the web app can actually
connect to the DNS server: a. In kudu console, run: Nameresolver.exe
[hostname-to-lookup] [dns-server-to-use]
First argument should be the
hostname you are trying to look up, second argument is one of the DNS
servers from step 1) If this times out, there is an issue with how
your DNS servers are configured (firewalls, etc.)
https://github.com/MicrosoftDocs/azure-docs/issues/13927#issuecomment-416382230
If using these settings with a DNS server that is only accessible via private IP, you would need to use regional vnet integration again to connect to a vnet. If the DNS server is on-prem, you have to connect through the integrated vnet over VPN or ExpressRoute.
It's possible but not using the private DNS Zone.
According to Name resolution for resources in Azure virtual networks. For the scenario Name resolution from App Service Web Apps in one virtual network to VMs in a different virtual network, you need to use your own DNS servers forwarding queries between virtual networks for resolution by Azure (DNS proxy). See Name resolution using your own DNS server.
In this case, you only allow this azure web service could resolve the public IP address outside of Azure. You could enable virtual network integration for your web app, this restricts your web app access in a private network. Then you could deploy a DNS server in the same Vnet as the web app integrated VNet. You could create an A type record in your DNS zone to point to your service Public IP, then add the DNS server's IP address into the DNS server of the Integrated web app Vnet in the portal. If so, the web app could resolve this public IP via a custom DNS server.
Hope this could help you.
I feel like I may be trying to sprint before I can even walk here, but I'm getting there! I've got a VM on Azure that I want to be able to access a local fileserver from. We have the following setup:
$COMPANY.net is the local domain, $COMPANY.com is the Azure domain. They are connected using Azure AD Connect, and the VM on Azure is using AADDS; we have a site to site vpn setup between Azure and our local network. I can put in the IP address of the local fileserver and reach it from the Azure VM, but I can't resolve the name if I try that. I believe it is a DNS problem, I need the Azure VM to use my local DNS server to resolve the host name rather than the AADDS addresses. Do I need to set up a DNS server on Azure that will point the requests to my local DNS, or is there another way?
Thank you!
You can specify DNS server for your Azure VM to use. The doc is quite large: https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances.md
Your name resolution needs might go beyond the features provided by Azure. For example, you might need to use Microsoft Windows Server Active Directory domains, resolve DNS names between virtual networks. To cover these scenarios, Azure provides the ability for you to use your own DNS servers.
I had a need to add additional public IP addresses to an Azure VM and found a working solution here:
Azure VM: More than one Public IP
Essentially this creates a reserved IP in Azure and then adds the reserved IP to a cloud service. Once it's bound to a cloud service it can be mapped to a VM endpoint.
This all works great but there is one bit I don't understand - The IP address of the reserved IP and the resultant VM endpoint don't match. I have to set up DNS to point to the IP address of the endpoint to make this work. Is there something I am not doing right, or is this just the way reserved VMs work?
It looks like this unanswered question is the same issue:
azure reserved IP for VM is diffrent than the given
Thanks!
The "Azure Cloud Service" is a container that provides internet connectivity to "Azure VMs". Thus, you assign the Internet facing Public IP to the Cloud Service. This article is relatively good at explaining the relationship: Azure Cloud Services
From above link:
Here’s a definition of an Azure IaaS cloud service that will make it easy for you to understand what it is in the context of Azure Infrastructure Services:
A cloud service is a network container where you can place virtual machines.
All virtual machines in that container can communicate with each other directly through Azure (and therefore don’t have to go out to the Internet to communicate with each other).
This container is also assigned a DNS name that is reachable from the Internet.
A rudimentary DNS server is created and can provide name resolution for all virtual machines within the same cloud service container (note that name resolution provided by the DNS server is only available to the virtual machines that are located within the cloud service).
One or more Virtual IP Addresses (VIPs) are assigned to the container and these IP addresses can be used to allow inbound connections from the Internet to the virtual machines.
Certain services (like FTP) may require your vm have a public IP: Azure VM Public IP
(IaaS v1) An Azure cloud service comes with a permanent DNS name - something.cloudapp.net - and has a single VIP allocated whenever there are VMs deployed in it OR whenever a reserved IP address is associated with it. Traffic is either load balanced or NATted (port forwarded) to the VM from the Azure Load Balancer sitting on the VIP. You can also associate a public instance-level IP address (PIP) with a VM, which gives it an additional IP address. The VIP always has a DNS name (something.cloudapp.net) while the PIP has one only if you specifically add it, I did a post which goes into these differences.
(IaaS v2) VMs are not deployed into cloud services and only have a public IP address if one is specifically added - either by configuring a PIP on the NIC of the VM (and optionally giving it a cloudapp.azure.com DNS name) or by configuring a load balancer and either load balancing or NATting traffic to it. This load balancer is configured with a public IP address and can optionally have a cloudapp.azure.com DNS name associated with it. (Ignoring internal load balancers in this discussion.)
I was wondering if I could change the DNS name on one of our azure servers from ######.cloudapp.net to mail.flyboeingva.org?
If so, how would I go about doing this?
Yes you can!
follow the tutorial Configure a custom domain name for Azure cloud service. Further more, if you are going to host e-mail server on azure, you may also want to:
Reserve an IP Address for your cloud service (your VM runs in a cloud service, don't get confused by the terms)
Register Reverse DNS record (PTR) for your cloud service / custom domain