Azure P2S VPN (Standard SKU) - Private Endpoints

Question

I have setup an Azure Point to Site (P2S) VPN via OpenSSL and Azure AD Authentication on a Generation 1 Standard SKU.
Connection via the Azure VPN Client works and I receive an IP from the VPN pool.
Also I can see that in the routing table the IP-range of my Virtual Network is listed.

Vnet: 192.168.200.0/24
Subnet: 192.168.200.0/25
GW Subnet: 192.168.200.128/28
VPN: 172.16.200.0/24

I have 2 private endpoints defined.
1 for SQL
1 for Azure File Share

Both are listed in the Private Endpoint section of the VNET
I also see DNS records in privatelink.file.core.windows.net (FileShare) and privatelink.database.windows.net (SQL).
So that looks good.

However, no connectivity is possible via:

Answer 1

Hi @ArnoudRaeven
You will need a DNS server that forwards this request to private DNS.
You can use a solution with a dDNS server or use the DNS Private Resolver feature

Reference: https://learn.microsoft.com/pt-br/azure/architecture/hybrid/hybrid-dns-infra

Reference: https://azure.microsoft.com/pt-br/resources/templates/dns-forwarder/

Get in touch if you need more help with this issue.

--please don't forget to "[Accept the answer]" if the reply is helpful--

Answer 2

@Jackson Martins thanks! New feature for me. Good!
Is there a set-by-step instruction available somewhere?

I have trouble to determine the in and outbound endpoints.
In theory only P2S VPN clients will connect, from various locations. So no fixed on prem IP range(s).

Answer 3

Hi @Jackson Martins ,

I've created the DNS Private Resolver succesfully.
However no change in DNS Name Resolution via Azure VPN Client.
$targetDNS1 = IP of Inbound Endpoint

I've also tested by putting the private endpoint IP's in a hostfile, ping doesn't work, but does use the private IP (as expected).
When I attempt to connect to <name>.privatelink.database.net via SQLSMS, the following error is returned:
"A connection was succesfully established with the server, but then an error occured during the login process. Targert Princple Name is incorrect."
Fixed that by selecting "Thrust Server Certificate" and subsequently the connection was made succesfully.

For <name>.privatelink.file.core.windows.net it also works when I use the hostfile.

When I remove the hostfile entry for both, it still doesn't work.
Any thoughts to what I might be overlooking?

Script I used is below:
Install-Module Az.DnsResolver
Get-InstalledModule -Name Az.DnsResolver

New-AzDnsResolver -Name CLIENT-dns-private-resolver -ResourceGroupName RESOURCEGROUP -Location westeurope -VirtualNetworkId "/subscriptions/SUBSCRIPTIONID/resourceGroups/RESOURCEGROUP/providers/Microsoft.Network/virtualNetworks/CLIENT.virtualnetwork"  
$dnsResolver = Get-AzDnsResolver -Name CLIENT-dns-private-resolver -ResourceGroupName RESOURCEGROUP  
$dnsResolver.ToJsonString()  
  
$ipconfig = New-AzDnsResolverIPConfigurationObject -PrivateIPAllocationMethod Dynamic -SubnetId /subscriptions/SUBSCRIPTIONID/resourceGroups/RESOURCEGROUP/providers/Microsoft.Network/virtualNetworks/CLIENT.virtualnetwork/subnets/CLIENT.inbound.subnet  
New-AzDnsResolverInboundEndpoint -DnsResolverName CLIENT-dns-private-resolver -Name DNS-Priv-Resolver-Inbound-Endpoint -ResourceGroupName RESOURCEGROUP -Location westeurope -IpConfiguration $ipconfig  
$inboundEndpoint = Get-AzDnsResolverInboundEndpoint -Name DNS-Priv-Resolver-Inbound-Endpoint -DnsResolverName CLIENT-dns-private-resolver -ResourceGroupName RESOURCEGROUP  
$inboundEndpoint.ToJsonString()  
  
New-AzDnsResolverOutboundEndpoint -DnsResolverName CLIENT-dns-private-resolver -Name DNS-Priv-Resolver-Outbound-Endpoint -ResourceGroupName RESOURCEGROUP -Location westeurope -SubnetId /subscriptions/SUBSCRIPTIONID/resourceGroups/RESOURCEGROUP/providers/Microsoft.Network/virtualNetworks/CLIENT.virtualnetwork/subnets/CLIENT.outbound.subnet  
$outboundEndpoint = Get-AzDnsResolverOutboundEndpoint -Name DNS-Priv-Resolver-Outbound-Endpoint -DnsResolverName CLIENT-dns-private-resolver -ResourceGroupName RESOURCEGROUP  
$outboundEndpoint.ToJsonString()  
  
New-AzDnsForwardingRuleset -Name DNSForwardingRuleSet -ResourceGroupName RESOURCEGROUP -DnsResolverOutboundEndpoint $outboundendpoint -Location westeurope  
$dnsForwardingRuleset = Get-AzDnsForwardingRuleset -Name DNSForwardingRuleSet -ResourceGroupName RESOURCEGROUP  
$dnsForwardingRuleset.ToJsonString()  
  
$vnet = Get-AzVirtualNetwork -Name CLIENT.virtualnetwork -ResourceGroupName RESOURCEGROUP   
$vnetlink = New-AzDnsForwardingRulesetVirtualNetworkLink -DnsForwardingRulesetName $dnsForwardingRuleset.Name -ResourceGroupName RESOURCEGROUP -VirtualNetworkLinkName "vnetlink" -VirtualNetworkId $vnet.Id -SubscriptionId SUBSCRIPTIONID  
$virtualNetworkLink = Get-AzDnsForwardingRulesetVirtualNetworkLink -DnsForwardingRulesetName $dnsForwardingRuleset.Name -ResourceGroupName RESOURCEGROUP   
$virtualNetworkLink.ToJsonString()  
  
$vnet2 = New-AzVirtualNetwork -Name CLIENT.dns.virtualnetwork -ResourceGroupName RESOURCEGROUP -Location westeurope -AddressPrefix "10.1.1.0/24"  
$vnetlink2 = New-AzDnsForwardingRulesetVirtualNetworkLink -DnsForwardingRulesetName $dnsForwardingRuleset.Name -ResourceGroupName RESOURCEGROUP -VirtualNetworkLinkName "vnetlink2" -VirtualNetworkId $vnet2.Id -SubscriptionId SUBSCRIPTIONID  
$virtualNetworkLink2 = Get-AzDnsForwardingRulesetVirtualNetworkLink -DnsForwardingRulesetName $dnsForwardingRuleset.Name -ResourceGroupName RESOURCEGROUP  
$virtualNetworkLink2.ToJsonString()  
  
$targetDNS1 = New-AzDnsResolverTargetDnsServerObject -IPAddress 192.168.210.4 -Port 53  
$forwardingrule = New-AzDnsForwardingRulesetForwardingRule -ResourceGroupName RESOURCEGROUP -DnsForwardingRulesetName DNSForwardingRuleSet -Name "AzurePrivate" -DomainName "." -ForwardingRuleState "Enabled" -TargetDnsServer $targetDNS1  

Answer 4

You can try the following to fix your set-up:

• do a nslookup for your SQL Servers FQDN like this:

nslookup myserver.database.windows.net 192.168.210.4

• assuming this will provide you with the private IP addres, you need to change theP2S profile XML file you use in the Azure VPN client tool to use this VPN by replacing the <clientconfig/> tag with:

	<clientconfig>
		<dnsservers>
			<dnsserver>192.168.210.4</dnsserver>
		</dnsservers>
	</clientconfig>