Private DNS Zone

Question

Private DNS Zone

James Lux 31

I have an Azure SQL Database, a Windows 10 VM and a CentOS VM all on the same VNet. I added a private endpoint to the SQL DB and linked it to the VNet. It correctly obtained an IP address from the VNet DHCP scope. So far so good.

I created a Private DNS Zone and the SQL IP Address was automatically added with an A Name of DBname.privatelink.database.windows.net.

Everything seems to be aligned.

However, from the Windows10 or CentOS VM, I cannot correctly resolve the private VNet address.

We also have Azure AD DS tied to this Azure VNet.

Tchimwa Sougang 946 Reputation points Microsoft Employee

2022-05-06T13:42:32.213+00:00
Hi @James Lux , once you decided to access your private endpoint via VPN. It requires a VPN forwarder on Azure. From what I can see You already have some custom DNS servers 209.244.0.3, 209.244.0.4.

Are they hosted on Azure? If yes, you need one of them to be the primary DNS server and you will have to configure 168.63.129.16 as forwarder. You certainly asked yourself why? It is simply because that IP 168.63.129.16 only lives on Azure, it is not routable on Internet. You can't reach from your laptop even connected via VPN. That's why you need that DNS forwarder.
Once you get that done, you will have to redownload the VPN configuration for your P2S connection.

If they are not hosted on Azure, please make sure you have a VM playing that role of DNS forwarder and use it as primary DNS server on your VNET.

https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns#virtual-network-and-on-premises-workloads-using-a-dns-forwarder

4 answers

Your answer

Tchimwa Sougang 946 Reputation points Microsoft Employee

2022-05-06T13:42:32.213+00:00

Hi @James Lux , once you decided to access your private endpoint via VPN. It requires a VPN forwarder on Azure. From what I can see You already have some custom DNS servers 209.244.0.3, 209.244.0.4.

Are they hosted on Azure? If yes, you need one of them to be the primary DNS server and you will have to configure 168.63.129.16 as forwarder. You certainly asked yourself why? It is simply because that IP 168.63.129.16 only lives on Azure, it is not routable on Internet. You can't reach from your laptop even connected via VPN. That's why you need that DNS forwarder.
Once you get that done, you will have to redownload the VPN configuration for your P2S connection.

If they are not hosted on Azure, please make sure you have a VM playing that role of DNS forwarder and use it as primary DNS server on your VNET.

https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns#virtual-network-and-on-premises-workloads-using-a-dns-forwarder

Answer 1

Carlos Solís Salazar 18,201 MVP Volunteer Moderator

Hi @James Lux

Thank you for asking this question on the **Microsoft Q&A Platform. **

I understand that you require to resolve DBname.privatelink.database.windows.net from your network, right?

In your DNS you need to set a Conditional Forward for database.windows.net to 168.63.129.16.

The conditional forwarding must be made to the recommended public DNS zone forwarder. For example: database.windows.net instead of privatelink.database.windows.net.

You have more information in https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns and https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

Hope this helps,
Carlos Solís Salazar

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.
NOTE: To answer you as quickly as possible, please mention me in your reply.

James Lux 31 Reputation points

2022-04-26T13:06:25.68+00:00

This does not really make sense. You state "In your DNS you need to set a Conditional Forward for database.windows.net to 168.63.129.16." However, I am unclear in what DNS you are talking about. This is all in Azure; VNet with SQL Database, Windows10 VM and CentOS VM. The VNet has DNS Servers set to 209.244.0.3, 209.244.0.4 and 168.63.129.16.

All resources (SQL & 2 VMs) have 10.0.1.x IP addresses, so on same Subnet.

When on the Windows VM or Linux VM, nslookup does not resolve DBname.privatelink.database.windows.net to the private IP address. The Microsoft documentation indicates internal DNS on the VNet is "taken care of" by the Azure platform.

Neither the Windows or Linux VM are linked to AD in any way, they only exist in the VNet.
Carlos Solís Salazar 18,201 Reputation points MVP Volunteer Moderator

2022-04-26T13:45:51.457+00:00

@James Lux

Put first the DNS 168.63.129.16 on the lists of your DNS server on the VNET DNS configuration.

Remember to clear the DNS cache of the servers.

Let me know if it works.

Hope this helps,
Carlos Solís Salazar

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.

NOTE: To answer you as quickly as possible, please mention me in your reply.
James Lux 31 Reputation points

2022-04-26T17:47:46.487+00:00

Please see my comment below. It was too many characters to put in a response.

Answer 2

Alberto Morillo 34,676 MVP Volunteer Moderator

Try linking the Vnet to the private dns zone for resolution.

Answer 3

I continue to have problems with the Point to Site VPN DNS despite following the proper MS instructions. I prefer not to use a hack to make this work.

Here are my details.

VNet is setup correctly with Custom DNS servers: 168.63.129.16, 209.244.0.3 and 209.244.0.4
I then added a a Virtual Network Gateway linked to this VNet
Next I added a Point to Site configuration with Azure AD Authentication
I downloaded the VPN Client File from the Portal and imported it into my installed Azure VPN Client on my mac
I can connect to the Azure VPN Gateway and the client shows 168.63.129.16, 209.244.0.3 and 209.244.0.4 as the VPN DNS Servers

So, this should be working.

Here is some information from testing....on my Mac

Without VPN connected

The output of scutil --dns | grep nameserver | sort -u shows nameserver[0] : 192.168.2.1 as the only DNS server
The result of nslookup awh-datawarehouse.database.windows.net shows Server: 192.168.2.1 and Address: 40.79.153.12
This is correct without the VPN connected

With VPN connected

The output of scutil --dns | grep nameserver | sort -u shows nameserver[0] : 168.63.129.16, nameserver[0] : 192.168.2., nameserver[1] : 209.244.0.3 & nameserver[2] : 209.244.0.4
The result of nslookup awh-datawarehouse.database.windows.net shows Server: 209.244.0.3 and Address: 40.79.153.12
This is incorrect; for some reason the VPN network is not returning the awh-datawarehouse.database.windows.net returned from the first DNS server

On a Linux VM on the VNet

The output of cat /etc/resolve.conf shows search reddog.microsoft.com, nameserver 168.63.129.16, nameserver 209.244.0.3 & nameserver 209.244.0.4
The result of nslookup awh-datawarehouse.database.windows.net shows Server: 168.63.129.16 and Address: 10.0.1.6
This is correct

How do I get the DNS resolver at 168.63.129.16 to properly return the Private IP Address (10.0.1.6) when VPN is connected? DNS is working when on a VM (windows or linux) on the VNet and the configuration appears to be correct. What can I do next?

Answer 4

Carlos Solís Salazar 18,201 MVP Volunteer Moderator

@James Lux

About this

This is incorrect; for some reason the VPN network is not returning the awh-datawarehouse.database.windows.net returned from the first DNS server

I think that could be because when you are on a VPN you have a split connection

Try to use the private link name (DBname.privatelink.database.windows.net)

Also, from a host in the VPN, run these commands:

nslookup awh-datawarehouse.database.windows.net 168.63.129.16  
nslookup DBname.privatelink.database.windows.net 168.63.129.16

With those commands, we are forcing do the DNS consult to that specific DNS server

Hope this helps,
Carlos Solís Salazar

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.
NOTE: To answer you as quickly as possible, please mention me in your reply.

James Lux 31 Reputation points

2022-04-27T13:07:15.013+00:00

Since I put this post in, I started to think the problem is upstream in the VPN tunnel. This test confirms that.

Both these commands return the same thing: ;; connection timed out; no servers could be reached

nslookup awh-datawarehouse.database.windows.net 168.63.129.16
nslookup DBname.privatelink.database.windows.net 168.63.129.16

I then added a route on my Mac like this: route add 168.63.129.16 10.1.0.2 which will force traffic to 168.63.129.16 over the VPN interface 10.1.0.2. I get the same message: ;; connection timed out; no servers could be reached

I believe the problem is that the VPN <> Vnet connection is not passing the DNS request to the 168.63.129.16 server.
Carlos Solís Salazar 18,201 Reputation points MVP Volunteer Moderator

2022-04-28T12:10:20.227+00:00

@James Lux

Probably, you already read these posts, but it is worth making double-checking.

https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns
https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

Hope this helps,
Carlos Solís Salazar

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.
NOTE: To answer you as quickly as possible, please mention me in your reply.
Carlos Solís Salazar 18,201 Reputation points MVP Volunteer Moderator

2022-05-02T21:51:58.147+00:00

@James Lux , How did it go?

Accept Answer and Upvote, if the above response helped answer your query, others visiting the forum with the same query might get help.

NOTE: To answer you as quickly as possible, please mention me in your reply.

Share via

Private DNS Zone

4 answers

Your answer