DNS mai zaman kansa na Azure akan VPN: wurin resolver ko forwarder
Duka tsare-tsaren biyu suna amsa yankuna na sirri ta tunnel. Kwatanta wurin shiga da ake sarrafawa da VM forwarder, sannan duba hanyar da dole ta kasance a kowane hali.
Sabar da ke cikin gida tana isa VM na Azure ta adireshin sirri amma har yanzu ba ta iya warware sunan mai masaukin sirri, wanda ke sa mutane su nemi gurbataccen tunnel. Tunnel ɗin yana da kyau. Abin da ya ɓace shi ne iyakar DNS: babu wani abu a ɓangaren gida da ya san cewa wani yanki na sirri na Azure dole ne resolver da ke cikin VNet ya amsa. Tsare-tsare biyu suna rufe wannan gibin, kuma sun bambanta a abin da kuke sarrafawa a ƙarshe, ba a ko tambayoyin suna aiki ba.
Tunnel ɗin yana ɗaukar tambayoyi, ba ilimin yanki ba
Haɗin site-to-site yana ba fakiti hanya tsakanin cibiyoyin biyu. Ba ya gaya wa sabar DNS ta gida wane filin suna na Azure ne ko wane adireshi zai amsa, don haka tambayar ko dai tana zuwa intanet kuma ta dawo fanko, ko kuma ba ta taɓa barin resolver na gida ba.
Gyaran yana da rabi biyu waɗanda ke da sauƙin rabuwa. Ɗaya rabin resolver ne a cikin VNet wanda ke karɓar tambayoyin da ke zuwa ta tunnel. Ɗayan kuma forwarder na sharadi ne a ɓangaren gida wanda ke aika filin suna ɗaya daidai zuwa wannan resolver. Babu rabin da ke aiki shi kaɗai.
A ɗauka yankin shine cloud.corp.example ga sauran wannan bayanin, kuma ɗauki kowane adireshi a matsayin misali.
Zaɓi A: wurin shiga da ake sarrafawa
Azure DNS Private Resolver yana ba da wurin shiga wanda ke karɓar tambayoyin DNS daga wajen VNet. Kuna tura shi cikin wani subnet ɗin da aka keɓe, ku haɗa yankin sirri da wannan VNet, sannan ku rubuta adireshin shiga da sabis ɗin ke bayarwa.
Sannan a kan sabar DNS ta gida kuna ƙirƙirar forwarder na sharadi don ainihin filin suna zuwa wannan adireshin:
Namespace: cloud.corp.example
Forward to: 10.20.2.4Hanyar DNS haɗe-haɗe ta Microsoft tana rubuta duka haɗin yankin da matakin forwarder. Hanyar da ake sarrafawa ba ta bar muku wata manhajar DNS da za a gyara, kuma adireshin wurin shiga yana dawwama tsawon rayuwar albarkatun.
Farashin shi ne cewa yanzu kuna da albarkatun resolver, wakilcin subnet ɗinsa da kuɗinsa, wanda yake na gaske ko da yawan tambayoyin kaɗan ne.
Zaɓi B: VM forwarder a cikin VNet
Tsofaffin tsare-tsaren suna gudanar da manhajar DNS a kan talakawan VM a cikin VNet: Windows DNS, BIND ko dnsmasq, tare da yankin sirri ko dai ana ɗaukarsa a gida ko kuma a tura shi zuwa resolver ɗin Azure a 168.63.129.16. Forwarder ɗin sharadi na gida yana nuni zuwa adireshin sirri na wannan VM.
Wannan zaɓi sananne ne ga ƙungiyoyin da suka riga suna gudanar da sabobin DNS, kuma yana iya ɗaukar ƙarin dabaru kamar rubuta log ko amsoshin split-horizon. Hakanan yana gado kowane aikin gudanarwa na sabar DNS: gyara, ƙarin misali na biyu don samuwa, sa ido, da hanyar sake ginawa sa'ad da aka maye gurbin VM kuma adireshinsa ya canza.
Talakawan mai masaukin VNet ba proxy na DNS ba ne har sai an shigar da sabis ɗin kuma an ba shi izinin amsa waɗannan abokan ciniki, kuma wannan shine matakin da mutane ke tsallakewa yayin kwafin VM.
Wanne ya dace da ayyukan ku
Kwatancen ba game da wanne tsari ya fi sauri ba ne. Game da ko kuna son gudanar da manhajar DNS kwata-kwata ne, da kuma ko yawan tambayoyin yana tabbatar da wata albarkatun da ake sarrafawa wadda ake lissafin kuɗi bisa wurin shiga da bisa tambaya.
| Question | Managed inbound endpoint | Forwarder VM |
|---|---|---|
| Software to patch | None | The DNS service on every instance |
| Address stability | Fixed for the resource lifetime | Tied to the VM or its reserved address |
| Availability work | Handled by the service | Second instance, health checks, failover |
| Extra logic | Limited to resolver features | Whatever the DNS software supports |
Ko wane layi ya yanke shawara, ka'idar forwarder a gida ɗaya take. Wannan shine ɓangaren da dole ne ya kasance a cikin duka tsare-tsaren, kuma shine ɓangaren da aka fi rasa sa'ad da wani ya ba da rahoton cewa warwarewa tana aiki daga cikin Azure amma ba daga ofis ba.
Duba hanyar bisa tsari
Tabbatar an haɗa yankin da VNet ɗin da ke ɗauke da resolver, kuma forwarder ɗin gida yana ambaton filin suna ba babban yanki ba. Forwarder na corp.example ba zai dace da cloud.corp.example ba sai idan resolver ɗin da kansa ya wakilta, kuma rashin daidaituwar yana haifar da amsa mara kyau mai tsabta wadda take kama da rikodin da ya ɓace.
Sannan duba cewa tambayar ta isa wurin shiga: tushen gida yana buƙatar hanya zuwa adireshin resolver da hanyar dawowa, kuma ya kamata a ba da izinin tashar 53 na UDP da TCP inda manufar ta yarda. NSG ba zai iya samar da rikodin yankin da ya ɓace ba, kuma daidaitaccen yanki ba zai iya amsa tambayar da ba ta taɓa zuwa ba.
Riƙe FQDN da aka nema kusa da resolver ɗin da kuka zaɓa lokacin bincike, kuma rabbe lokacin ƙarewa daga amsa mara kyau. Lokacin ƙarewa matsalar hanya ce ko manufa. Amsa mara kyau tana nufin tambayar ta iso kuma filin sunan bai dace ba. Tsarin aiki: haɗa yankin, ƙara forwarder ɗin sharadi, buɗe tashar 53 a duka kwatance, gwada suna ɗaya daga gida, sannan kawai duba izinin aikace-aikacen kansa.