I-DNS yangasese ye-Azure nge-VPN: iphuzu lokugcina le-resolver noma i-forwarder
Womabili amadizayini aphendula izindawo eziyimfihlo ngomhubhe. Qhathanisa iphuzu lokugcina lokungena elilawulwayo ne-VM ye-forwarder, bese uhlola indlela okufanele ibe khona kuzo zombili izimo.
Iseva endaweni ifinyelela i-VM ye-Azure ngekheli langasese kodwa ayikwazi ukuxazulula igama layo lomhambi langasese, okwenza abantu bafune umhubhe ophukile. Umhubhe ulungile. Okushodayo umngcele we-DNS: akukho lutho ohlangothini lwasekhaya olwaziyo ukuthi indawo ethile yangasese ye-Azure kumele iphendulwe i-resolver ngaphakathi kwe-VNet. Amadizayini amabili avaliyo lesikhala, futhi ahluka kulokho okuqeda ukukusebenzisa, hhayi ekutheni imibuzo iyasebenza yini.
Umhubhe uthwala imibuzo, hhayi ulwazi lwendawo
Ukuxhumana kwe-site-to-site kunikeza amaphakethe indlela phakathi kwamanethiwekhi amabili. Akutsheli iseva ye-DNS yasekhaya ukuthi iyiphi indawo yamagama eng eyase-Azure noma iyiphi ikheli okufanele liphendule, ngakho umbuzo uyaya ku-inthanethi futhi ubuya ungenalutho, noma awuphumi neze ku-resolver yasekhaya.
Ukulungisa kunezingxenye ezimbili okulula ukuzihlukanisa. Ingxenye eyodwa i-resolver ngaphakathi kwe-VNet eyamukela imibuzo efika ngomhubhe. Enye i-forwarder enombandela ohlangothini lwasekhaya ethumela indawo eyodwa yamagama kuleyo resolver. Ayikho ingxenye esebenza yodwa.
Ake sithi indawo yi-cloud.corp.example kuso sonke lesi sichasiso, futhi thatha yonke ikheli njengesibonelo.
Ukukhetha A: iphuzu lokugcina lokungenayo elilawulwayo
I-Azure DNS Private Resolver inikeza iphuzu lokugcina lokungenayo elamukela imibuzo ye-DNS evela ngaphandle kwe-VNet. Uyisebenzisa kusubnet egunyaziwe ekhethekile, uxhuma indawo yangasese kuleyo VNet, futhi ubhala ikheli lokungenayo elinikezwa yisevisi.
Khona-ke kusiseva ye-DNS yasekhaya wakha i-forwarder enombandela yendawo eqondile yamagama eya kulelo kheli:
Namespace: cloud.corp.example
Forward to: 10.20.2.4Inqubo ye-DNS exubile yakwa-Microsoft ibhala kokubili ukuxhumana kwendawo kanye nesinyathelo se-forwarder. Indlela elawulwayo ayishiye software ye-DNS okufanele ilungiswe, futhi ikheli lephuzu lokugcina lihlala lizinzile kukho konke ukuphila kwensiza.
Intengo iwukuthi manje usunensiza ye-resolver, ukugunyazwa kwayo kwesubnet kanye nezindleko zayo, okuyiqiniso ngisho lapho inani lemibuzo lincane kakhulu.
Ukukhetha B: i-VM ye-forwarder ngaphakathi kwe-VNet
Idizayini endala isebenzisa software ye-DNS ku-VM evamile ngaphakathi kwe-VNet: Windows DNS, BIND noma dnsmasq, kanti indawo yangasese isingathwa endaweni noma idluliselwe ku-resolver ye-Azure ku-168.63.129.16. I-forwarder enombandela yasekhaya ikhomba ekhelini langasese laleyo VM.
Lokhu kukhetha kwaziwa amaqembu asevele esebenzisa amaseva e-DNS, futhi kungathwala umqondo owengeziwe njengokuloga noma izimpendulo ze-split-horizon. Futhi kuzuza wonke umsebenzi wokusebenza wesiseva se-DNS: ukulungisa, inguqulo yesibili yokutholakala, ukuqapha kanye nendlela yokwakha kabusha lapho i-VM ishintshwa futhi ikheli layo lishintsha.
Umhambi ovamile we-VNet akayona i-proxy ye-DNS kuze kufakwe isevisi futhi ivunyelwe ukuphendula labo baklayenti, futhi leso yisinyathelo abantu abasishiyayo lapho bekwenza ikhophi ye-VM.
Iyiphi efanele ukusebenza kwakho
Ukuqhathanisa akukhona ngokuthi iyiphi idizayini eshesha kakhulu. Kukhona ngokuthi uyafuna yini ukusebenzisa software ye-DNS nhlobo, nokuthi inani lemibuzo liyayisekela yini insiza elawulwayo ekhokhisa ngokwephuzu lokugcina nangombuzo.
| Question | Managed inbound endpoint | Forwarder VM |
|---|---|---|
| Software to patch | None | The DNS service on every instance |
| Address stability | Fixed for the resource lifetime | Tied to the VM or its reserved address |
| Availability work | Handled by the service | Second instance, health checks, failover |
| Extra logic | Limited to resolver features | Whatever the DNS software supports |
Noma yimuphi umugqa onqumayo, umthetho we-forwarder wasekhaya ubukeka ufana. Le yingxenye okufanele ibekhona kuzo zombili izidizayini, futhi iyona engxenyeni evame ukushoda lapho othile ebika ukuthi ukuxazulula kuyasebenza ngaphakathi kwe-Azure kodwa hhayi ehhovisi.
Hlola indlela ngokulandelana
Qinisekisa ukuthi indawo ixhunyiwe ne-VNet ephethe i-resolver, nokuthi i-forwarder yasekhaya isho indawo yamagama hhayi isizinda somzali. I-forwarder ye-corp.example ngeke ihambisane ne-cloud.corp.example ngaphandle uma i-resolver ngokwayo igunyaza, futhi ukungahambisani kukhiqiza impendulo engeyinhle ehlanzekile ebonakala njengerekhodi elahlekile.
Bese uhlola ukuthi umbuzo ufinyelela iphuzu lokugcina: umthombo wasekhaya udinga indlela eya ekhelini le-resolver kanye nendlela yokubuya, futhi imbobo engu-53 kufanele ivunyelwe kokubili i-UDP ne-TCP lapho inqubomgomo ivuma khona. I-NSG ayikwazi ukunikeza irekhodi lendawo elahlekile, futhi indawo efanele ayikwazi ukuphendula umbuzo ongafiki neze.
Lapho uhlola, gcina i-FQDN eceliwe eduze kwe-resolver oyikhethile, futhi uhlukanise ukuphela kwesikhathi nempendulo engeyinhle. Ukuphela kwesikhathi inkinga yendlela noma yenqubomgomo. Impendulo engeyinhle isho ukuthi umbuzo ufike futhi indawo yamagama ayihambisananga. Ukulandelana komsebenzi: xhuma indawo, engeza i-forwarder enombandela, vula imbobo engu-53 kuzo zombili izinhlangothi, hlola igama elilodwa kusuka endaweni, bese kuthi ngemva kwalokho ubheke ukugunyazwa kwalo uhlelo lokusebenza.