Connect to AzureVM that is accessible only from VNET using Public DNS

Alexander Shushanidze 41

Hi. I want to have a setup with multiple peered VNets and VPN Gateway for clients to join these networks. Right now we have a VM protected with a firewall by IP, but I want to have access only from VNet. When I do that I lose the ability to use the Public DNS name that is provided by Azure. Is there a way that allows me to use Public URL but allows connections from peered VNets? For example, I can access AzureMSSQL Server from VNet because of "Allow Azure services and resources to access this server
" setting. Can I do that to VMs?

SaiKishor-MSFT 17,186 Reputation points

2020-11-20T07:48:21.417+00:00
@Alexander Shushanidze

Thanks for your question on Q&A. Please confirm the following to assist you further-

When you connect to MSSQL- Do you connect to it using a private IP or public IP?

Does the MSSQL have a service endpoint or private link using which you connect to it from the other vnet or do you connect to it via vnet peering?

When you say, you want you want to use public url to connect, who do you want to connect to i.e., what is the source? is it the other vnet or clients from internet? and what do you want them to connect to i.e., is it the Virtual machines inside the VNET?

Thank you!
Alexander Shushanidze 41 Reputation points

2020-11-20T07:57:13.467+00:00
Hi @SaiKishor-MSFT .

I'm using a DNS name of MSSQL Server that provided by Azure

I have "Allow Azure services and resources to access this server" setting turned on. I have other IPs allowed but I have the ability to connect from my VMs that are not part of that IP whitelist

I want to connect using Public DNS name from my VMs / Clients that are using VPN Gateway to VMs inside of VNet
SaiKishor-MSFT 17,186 Reputation points

2020-11-20T17:50:49.147+00:00

@Alexander Shushanidze

It is not possible to connect to VMs inside VNET via the Vnet Gateway using their Public IPs due to the architecture of the Azure Cloud. Only if you access it directly via the internet, this is possible. With respct to MSSQL, can you confirm the IP address that it translates to when you access it from the other VMs?
Alexander Shushanidze 41 Reputation points

2020-11-23T09:18:57.217+00:00

@SaiKishor-MSFT yea, nslookup shows that MSSQL resolves with a public IP address, which makes sense... So in order to implement what I want to do the only way is to create Private DNS and manually assign all the IPs, also install necessary SSL certificates, etc?.. How this " closed network " thing is usually implemented and used? Does everyone just use private IPs?

Thanks.
SaiKishor-MSFT 17,186 Reputation points

2020-11-25T23:10:27.387+00:00

@Alexander Shushanidze

Yes you need to access these VMs using their Private DNS names if using VNET peering or VNET GW to reach the resources. If you wish to use Azure provided Azure DNS names, you can configure private DNS Zone and integrate your VNET to it, here are more details. You can also implement a custom DNS, here are details for the same. Here are some details regarding vnet peering and how it works. Please let me know if you have any further questions and we will be glad to answer them for you. Thank you!

Accepted answer

SaiKishor-MSFT 17,186 Reputation points

2020-11-26T06:14:19.713+00:00

@Alexander Shushanidze

Yes you ideally need to access these VMs using their Private DNS names if using VNET peering or VNET GW to reach the resources. If you wish to use Azure provided Azure DNS names, you can configure private DNS Zone and integrate your VNET to it, here are more details. You can also implement a custom DNS, here are details for the same. Here are some details regarding vnet peering and how it works.

However, after some investigation, I figured that you can also use public DNS names if needed. You can achieve this using the hosts.txt file on Windows, or by adding a record to your local DNS server (if the computers use a local DNS, not a public one).

Please let me know if you have any further questions and we will be glad to answer them for you. Thank you!
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Connect to AzureVM that is accessible only from VNET using Public DNS

0 additional answers