how to access azure storage account using private endpoint via azure P2S

Question

hi,

A scenario where a client is using Point-to-Site connectivity and attempting to connect to an Azure Storage account through its private endpoint, the issue arises when the Storage account FQDN resolves to a public IP instead of the private endpoint IP. This results in a situation where users trying to connect using Storage Explorer encounter the error message: 'This request is not authorized to perform this operation without using the ER or S2S tunnel.

Can this be achieved using P2S ?

Answer 1

@$@chin ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you have a requirement that P2S users have to connect a Storage Account's private endpoint.

Silvia Wibowo's suggestion is correct.

• Adding Add DNS suffixes would make the DNS requests for *.blob.core.windows.net go via the P2S Tunnel
• However, just using the DNS Suffixes is not enough.
• You should also use a custom DNS server in Azure if you want Private endPoints to be resolved.
  • This means, you should have a VM acting as DNS Server located in Azure VNET where the VPN Gateway is deployed.
  • In addition, the VM DNS Server should have a forward lookup zone for "blob.core.windows.net" and forward the requests to Azure Wireserver IP - 168.63.129.16.
• You may wonder why you cannot directly forward the requests to 168.63.129.16 without ever deploying a VM DNS Server
  • The answer is that 168.63.129.16 is a virtual IP and it will accept only DNS queries from VMs in Azure
  • Not directly from P2S Clients.
• See : Use a DNS forwarder VM
  • 
  Steps 1 and 2 are done by Add DNS suffixes and custom DNS server

The recommended method is to use Azure DNS Private Resolver instead, which can act as a DNS VM in Azure and has less management overhead.

For non-production scenarios,

• You can consider using Host file entry
• Infact, I recommend you to make sure the host file entry works before you move to custom DNS server or Azure DNS Private Resolver solutions.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 2

Hi @$@chin , I understand that you're having issues connecting to Azure Storage private endpoint via VPN P2S.

Modify the downloaded profile XML file (for Azure P2S Client) and add these tags:

<dnssuffixes> <dnssuffix>.privatelink.blob.core.windows.net </dnssuffix> </dnssuffixes>

Reference: Add DNS suffixes

If <dnssuffix>.privatelink.blob.core.windows.net</dnssuffix> does not work, try <dnssuffix>.blob.core.windows.net</dnssuffix>

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.