Unable to resolve custom DNS name for virtual machines via VPN

Thank you @KapilAnanth-MSFT for your suggestion.

I dont want to go with VM as DNS Server option if the same can be achieved using Private DNS Resolver because of maintenance and cost overhead associated to a VM.

The link you've shared talks about the situation when you've a DNS solution on-premise which is not the case here. We don't have any DNS solution on-premise, and only Azure Private DNS zones in the subscriptions. Anyone can connect using P2S VPN and there's no DNS forwarder on-premise.

As you mentioned P2S have no knowledge of Private DNS zones (is this mentioned somewhere in the official docs?) so I need some more specific help in configuring the DNS resolution system as I have spent so much time on this and now I am exhausted :/

You can assume that DNS requests are not coming in from AWS, and I have created a Private DNS resolver in the sub1;

• What do I need to add in the inbound and outbound addresses? (remember the end goal is just to be able to resolve DNS over P2S VPN)
• Do I need to make any changes to the VNet's DNS?
  • If I have to set it to private DNS zone how will it entertain Azure DNS queries? I hope those services won't stop working
• Exactly what changes do I need to make to the VPN configuration file?
  • Do I need to make some changes on Azure portal as well?
  • If I want VPN file to be generated using the domain suffixes, how can that be achieved?

Thank you!

@Najam ul Saqib , You are welcome :)

Wrt, "The link you've shared talks about the situation when you've a DNS solution on-premise which is not the case here. We don't have any DNS solution on-premise, and only Azure Private DNS zones in the subscriptions."

• This is why I mentioned "You should take care of your OnPrem (in your case, AWS VPC) forwarding the DNS requests to the Inbound EndPoint of Private DNS Resolver in case of S2S"
• You should use a DNS forwarder to forward the requests specific to the Private DNS Zones
• Alternatively, you can instead forward any and all DNS requests to the Inbound EndPoint
  • This does not need you to deploy a DNS forwarded at the OnPrem (everything as in "www.google.com" , "www.example.com")
  • However, in case of an issue with the S2S, you should make sure there is a local back up DNS Server

Wrt, "As you mentioned P2S have no knowledge of Private DNS zones (is this mentioned somewhere in the official docs?)"

• Private DNS Zones are only linked to the Virtual Network, they are not extended to the S2S or P2S
  • See : What is an Azure Private DNS zone?
  • 
• Remote Networks are not part of the Virtual Network itself
• Remote Networks are an extension of the VNET and they always have their own DNS, Gateway etc.

To address your other queries,

1.What do I need to add in the inbound and outbound addresses? (remember the end goal is just to be able to resolve DNS over P2S VPN)

• They are auto configured.
• When you create the Private DNS Resolver, you can either set them as dynamic (any IP from the subnet) or static (you can pick a IP of your choice from the subnet)

2.Do I need to make any changes to the VNet's DNS? If I have to set it to private DNS zone how will it entertain Azure DNS queries? I hope those services won't stop working

• Azure DNS queries are handled by Wireserver IP (Default)
• Please note the Order of DNS Query here
  • The Default (Azure-provided) DNS server takes precedence over Private DNS Resolver.
• So existing VMs in the VNET will not face any problems (provided the VNET is using Default DNS Server)
  • 

3.Exactly what changes do I need to make to the VPN configuration file?

• Do I need to make some changes on Azure portal as well? - NO
• If I want VPN file to be generated using the domain suffixes, how can that be achieved? - It's not supported as of now
  • You can instead modify a file and distribute it at scale instead of requesting users to download from the VPN Gateway directly.

A step by step instruction on how to set this up is provided in Resolve Azure and on-premises domains

• Here, the Zone "azure.contoso.com." is used as an example against your scenario.
• You can skip the steps with "OutboundEndPoint" and "RuleSet" creation.
• You only have to
  • Create a Private DNS Resolver (this will need a subnet for InBoundEndPoint) in your HubVNET
  • Note the IP Address of the InBoundEndPoint
  • Use it as the DNS Server for OnPrem (S2S) - forward all requests to this IP.
  • For P2S,
    • Add it to the custom DNS servers of the P2S Configuration file.
    • Add the domain "azure.contoso.com." in DNS suffixes

Hope this helps

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

@KapilAnanth-MSFT

Thanks a bunch, I was able to resolve DNS locally using this, I have a couple more questions before I can proceed with accepting the answer and closing the question:

1. Even though via P2S I was able to RDP using DNS name which meant it was getting resolved, but when I ran nslookup on the DNS name it still returned the output of non-existent domain. Why so? I was able to run the nslookup and check private IP address from within the VM.
2. If we assign the dynamic IP to the inbound endpoint, do we need to update the VPN configuration file with the IP as it changes? How often the IP changes on a private DNS resolver?
3. What is the best practice to assign the subnet to private DNS resolver, how many IP addresses should be vacant in the subnet?
4. If I try to create a new subnet, and then assign a fixed IP from it, it throws error that its in reserved range, and if I use other subnet it complains that subnet is already connected to some other service.

@Najam ul Saqib , glad we could be of service.

1 . Even though via P2S I was able to RDP using DNS name which meant it was getting resolved, but when I ran nslookup on the DNS name it still returned the output of non-existent domain. Why so? I was able to run the nslookup and check private IP address from within the VM.

• I believe this behavior is expected and is similar to "nslookup" not respecting host file entry
• What do you see as the DNS Server when you perform nslookup?
  • Is it the local/ISP's DNS server or the Inbound EndPoint's IP?
• I believe, this is more related to the working of "nslookup" as a command than Azure or remote OS.
• If you notice, the results of (from Powershell)
  • ping <VM'sFQDN>
  • Test-NetConnection -ComputerName <VM'sFQDN> -Port 3389
• will give you the Private IP but nslookup may not

2 . a. If we assign the dynamic IP to the inbound endpoint, do we need to update the VPN configuration file with the IP as it changes?

• Yes.

2 . b. How often the IP changes on a private DNS resolver?

• See : Static and dynamic endpoint IP addresses
• "reprovisioned" here indicates updating the InboundEndpoint, not Route Server as a whole

3 . What is the best practice to assign the subnet to private DNS resolver, how many IP addresses should be vacant in the subnet?

• A subnet must be a minimum of /28 address space or a maximum of /24 address space.
• See : Subnet restrictions

4 . a. If I try to create a new subnet, and then assign a fixed IP from it, it throws error that its in reserved range,

• This is a restriction for any Azure subnet.
• See : Create the inbound endpoint | If the endpoint IP address is static, it can be specified and reused if the endpoint is reprovisioned. The IP address that you choose can't be a reserved IP address in the subnet.

4 . b. and if I use other subnet it complains that subnet is already connected to some other service.

• See : Subnet restrictions
  • The subnet can only be delegated to Microsoft.Network/dnsResolvers and can't be used for other services.
• This means, the subnet should be exclusive to Inbound endpoint and cannot contain any other service such as VMs or VMSS

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

@KapilAnanth-MSFT

Accepting the answer, you can answer the following questions at your ease as the case is resolved:

• If we dont update the inbound endpoint, it won't change the dynamic IP? If we just set one inbound endpoint and dont touch dns resolver again the IP wont change automatically right?
• The nslookup in cmd prompt is showing the local DNS server, can it be configured to consider the VPN's DNS server?
• The ping command does resolve to the private IP but then it returns timed out, why so? How can this be fixed?

Appreciation Note: Kapil, you're a super-hero on this platform. You understand the problem perfectly and suggest solutions in such an easy format. Kudos to you and to your dedication to help the community.