DNS gaar ah ee Azure oo VPN ku socda: meesha resolver ama forwarder
Labada naqshad waxay ka jawaabaan zones gaar ah tunnelka. Isbarbardhig meesha soo-gal ee la maamulo iyo VM forwarder, kadib hubi dariiqa ay tahay inuu jiro labada xaaladood.
Server ku yaal goobta ayaa gaadha Azure VM ciwaan gaar ah, haddana ma xallin karo magaciisa martigeliyaha gaar ah, taasoo dadka u dirto inay raadiyaan tunnel jabay. Tunnelku wuu fiican yahay. Waxa maqan waa xad DNS: wax goobta dhinaceeda ah ma oga in zone gaar ah Azure ay tahay in resolver ku jira VNet ka jawaabo. Laba naqshad ayaa buuxiya farqigaas, waxayna ku kala duwan yihiin waxa aad ugu dambaynta maamasho, ma aha in weydiimaha shaqeeyaan.
Tunnelku wuxuu qaadaa weydiimo, ma aha aqoonta zone
Xiriirka site-to-site wuxuu pakadaha siinayaa dariiqa labada shabakadood. Ma u sheego serverka DNS ee goobta nooca magaca ee Azure leeyahay ama ciwaanka jawaabta, sidaas darteed weydiinta ayaa ama internetka u gudba oo madhan soo noqota, ama marnaba kama baxo resolverka maxalliga ah.
Hagaajinta waxay leedahay laba qaybood oo si fudud loo kala saari karo. Hal qayb waa resolver ku jira VNet kaas oo aqbala weydiimaha tunnelka ku imanaya. Tan kale waa forwarder shuruud ku xiran dhinaca goobta oo u dira hal magac oo sax ah resolverkaas. Midkoodna keligiis ma shaqeeyo.
Ka soo qaad in zone uu yahay cloud.corp.example inta ka hartay sharaxaaddan, oo ciwaan kasta u qaado tusaale ahaan.
Xulasho A: meesha soo-gal ee la maamulo
Azure DNS Private Resolver wuxuu bixiyaa meel soo-gal ah oo aqbala weydiimaha DNS ee ka yimaada bannaanka VNet. Waxaad ku dhejisaa subnet gaar ah oo loo wakiilay, waxaad ku xirtaa zone gaar ah VNet taas, waxaadna qoraan ciwaanka soo-galka ee adeeggu bixiyo.
Kadib serverka DNS ee goobta waxaad u samaysaa forwarder shuruud ku xiran magaca saxda ah oo u jeeda ciwaankaas:
Namespace: cloud.corp.example
Forward to: 10.20.2.4Habka DNS hybrid ee Microsoft wuxuu diiwaangeliyaa xiriirka zone iyo tallaabada forwarder labadaba. Jidka la maamulo kuma tago software DNS la hagaajinayo, ciwaanka meesha soo-galkuna wuu sii ahaanayaa mid deggan inta uu resource-ku nool yahay.
Qiimaha waa in hadda aad haysato resource resolver, wakiilka subnetkiisa iyo kharashkiisa, taas oo dhab ah xitaa marka mugga weydiimuhu aad u yar yahay.
Xulasho B: VM forwarder ku jira VNet
Naqshadda hore waxay ku socodsiisaa software DNS VM caadi ah oo ku jira VNet: Windows DNS, BIND ama dnsmasq, zone gaarna ama gudaha ayaa lagu martigeliyaa ama waxaa loo gudbiyaa resolverka Azure ee 168.63.129.16. Forwarderka shuruud ku xiran ee goobta wuxuu tilmaamayaa ciwaanka gaarka ah ee VM taas.
Xulashadan way caan ku tahay kooxaha horey u maamula serverada DNS, waxayna qaadi kartaa macquul dheeraad ah sida diiwaangelinta ama jawaabaha split-horizon. Waxay sidoo kale dhaxashaa waajibaad kasta oo hawleed ee server DNS: hagaajin, nuqul labaad oo loogu talagalay helitaanka, la-socodka iyo dariiqa dib-u-dhiska marka VM la beddelo oo ciwaankiisu isbeddelo.
Martigeliyaha VNet caadi ah ma aha proxy DNS ilaa adeegga la rakibo oo loo oggolaado inuu u jawaabo macaamiishaas, taasina waa tallaabada dadku seegaan marka ay clone gareynayaan VM.
Midkee ku habboon hawshaada
Isbarbardhiggu kuma saabsana midkee naqshad degdeg badan. Waxay ku saabsan tahay inaad rabto inaad maamasho software DNS, iyo in mugga weydiimuhu uu qiil u yahay resource la maamulo oo lacag ka qaato meesha soo-galka iyo weydiinta.
| Question | Managed inbound endpoint | Forwarder VM |
|---|---|---|
| Software to patch | None | The DNS service on every instance |
| Address stability | Fixed for the resource lifetime | Tied to the VM or its reserved address |
| Availability work | Handled by the service | Second instance, health checks, failover |
| Extra logic | Limited to resolver features | Whatever the DNS software supports |
Sadar kastaa go'aansado, qaanuunka forwarderka goobta wuu isku mid yahay. Tani waa qaybta ay tahay inay ku jirto labada naqshad, waana qaybta inta badan maqan marka qof sheegto in xallintu ka shaqeyso gudaha Azure laakiin aan ka shaqeyn karin xafiiska.
Hubi dariiqa si taxane ah
Xaqiiji in zone ku xiran yahay VNet kaas oo haysta resolverka, iyo in forwarderka goobtu magacaabo magaca aan ahayn domain waalid. Forwarderka corp.example kuma habboonaan doono cloud.corp.example ilaa resolverka laftiisu wakiilo, aan iswaafajinna waxay soo saartaa jawaab diidmo nadiif ah oo u eg diiwaan maqan.
Kadib hubi in weydiintu gaadho meesha soo-galka: isha goobta waxay u baahan tahay dariiq ciwaanka resolverka iyo dariiq soo-noqod, iyo dekedda 53 waa in loo oggolaado UDP iyo TCP labadaba halka siyaasadu oggolaato. NSG ma bixin karo diiwaan zone maqan, zone sax ahna ma jawaabi karo weydiin aan marnaba iman.
Marka aad baarayso hayso FQDN la codsaday agteeda resolverka aad dooratay, oo kala sooc waqtiga dhammaadka iyo jawaabta diidmada. Waqtiga dhammaadku waa dhibaato dariiq ama siyaasad. Jawaab diidmo waxay ka dhigan tahay in weydiintu timid oo magacu aanu iswaafajin. Nidaamka shaqada: xiri zone, ku dar forwarderka shuruud ku xiran, fur dekedda 53 labada dhinac, tijaabi hal magac goobta, kadibna fiiri oggolaanshaha appka laftiisa.