Need some assistance with azure private endpoints | Microsoft Azure | Page 1

graceful rampart Sep 13, 2023, 12:19 AM

#

are the private dns zones the private endpoints are using linked to your vnet(s)?

frosty compass Sep 13, 2023, 12:22 AM

#

@graceful rampart I'm pretty sure they are from what I remember, but I left the office and I'll check tomorrow morning.

graceful rampart Sep 13, 2023, 12:23 AM

#

no worries, you should have a Private DNS Zone named privatelink.database.windows.net

That dns zone will need to be vnet linked in order for things in the vnet to resolve it.

frosty compass Sep 13, 2023, 12:23 AM

#

gotcha, thank you I'll test it tomorrow morning and let you know!

#

was able to check now

#

graceful rampart Sep 13, 2023, 12:27 AM

#

frosty compass Sep 13, 2023, 12:28 AM

#

graceful rampart Sep 13, 2023, 12:30 AM

#

that all seems okay to me. and nslookup isn't resolving?

frosty compass Sep 13, 2023, 12:30 AM

#

yeah its not resolving 😦

#

i mightve went wrong somewhere but i did the steps multiple times

graceful rampart Sep 13, 2023, 12:31 AM

#

you can see the A record in the zone?

#

or is the VM configured with a custom DNS server?

frosty compass Sep 13, 2023, 12:32 AM

#

vm is using whatever microsoft assigned us

#

just to be sure

#

the link name has to have a bunch of random numbers and letters right

graceful rampart Sep 13, 2023, 12:34 AM

#

frosty compass the link name has to have a bunch of random numbers and letters right

do you mean the generated nic?

frosty compass Sep 13, 2023, 12:34 AM

#

yeah, the generated nic

graceful rampart Sep 13, 2023, 12:34 AM

#

yeah that's fine

frosty compass Sep 13, 2023, 12:34 AM

#

#

and the record is in the zone as well

nimble flicker Sep 13, 2023, 12:35 AM

#

Go to your vnet, click on DNS... You'll either have "Azure provided" selected or IPs for custom DNS

graceful rampart Sep 13, 2023, 12:35 AM

#

yeah that's the only other thing I can think of. Might not be using Azure DNS

frosty compass Sep 13, 2023, 12:36 AM

#

checking now

graceful rampart Sep 13, 2023, 12:37 AM

#

if you end up checking via the VM, The azure provided dns server should be 168.63.129.16

frosty compass Sep 13, 2023, 12:37 AM

#

oh looks like its custom

#

graceful rampart Sep 13, 2023, 12:38 AM

#

yeah that's your problem

frosty compass Sep 13, 2023, 12:38 AM

#

sorry im not that good with networking lol

graceful rampart Sep 13, 2023, 12:38 AM

#

that custom DNS server needs to be aware of those private dns zones

frosty compass Sep 13, 2023, 12:38 AM

#

just started here 2 days ago and no documentation

#

ah okok

#

so to make sure im on the right page

#

so do I just

#

Record set and add those?

graceful rampart Sep 13, 2023, 12:41 AM

#

those DNS servers are another VM in a domain or something?

frosty compass Sep 13, 2023, 12:42 AM

#

i think our director made them and left

graceful rampart Sep 13, 2023, 12:42 AM

#

lmao

nimble flicker Sep 13, 2023, 12:43 AM

#

Fingers crossed that he didn't leave 3 envelopes behind...

graceful rampart Sep 13, 2023, 12:43 AM

#

probably worth investigating whats at those IP addresses and what they're doing as they might be supporting DNS for other things.

#

if you need to leave them as is, looks like DNS Private Resolver is the preferred solution to link up with the private dns zones.

https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/dns-for-on-premises-and-azure-resources

DNS for on-premises and Azure - Cloud Adoption Framework

Examine key design considerations and recommendations surrounding DNS for on-premises and Microsoft Azure.

#

you could also just create the needed A records on those custom dns servers but that's not good long term

frosty compass Sep 13, 2023, 12:45 AM

#

theyre not filling anything

nimble flicker Sep 13, 2023, 12:45 AM

#

Private Resolver would be in lieu of custom DNS servers.

frosty compass Sep 13, 2023, 12:46 AM

#

u guys think it should be best to start from scratch

#

for this particular

graceful rampart Sep 13, 2023, 12:46 AM

#

nimble flicker Private Resolver would be in lieu of custom DNS servers.

you would use the private resolver to get the resolution from custom to azure private dns

#

whilst keeping the custom dns in the chain, assuming it's needed

graceful rampart Sep 13, 2023, 12:46 AM

#

frosty compass theyre not filling anything

if they're not actually doing anything then just switch the VM to use azure provided DNS and you should be good to go

nimble flicker Sep 13, 2023, 12:47 AM

#

You're just adding a redundant forwarder to the chain in that case. From custom DNS, all you need to do is add a conditional forwarder to Azure's recursive resolver.

nimble flicker Sep 13, 2023, 12:48 AM

#

graceful rampart if they're not actually doing anything then just switch the VM to use azure prov...

But, yeah, this. If the VMs aren't actually server up DNS, there's not much reason to point VMs there for DNS lookups.

graceful rampart Sep 13, 2023, 12:48 AM

#

yeah would work. but who knows where those DNS servers are pointing lmao. I've seen some orgs setup windows DNS in Azure then immediately point it to onprem ignoring everything azure provided.

frosty compass Sep 13, 2023, 12:49 AM

#

let me get back to this tomorrow, i have to do more investigation before i say for sure

#

more stuff in the office lol, infosec gonna wonder why im on my personal laptop lol

nimble flicker Sep 13, 2023, 12:49 AM

#

graceful rampart yeah would work. but who knows where those DNS servers are pointing lmao. I've s...

Yeah, that's a fair point. Triggering some DNS PTSD now...

#

Had a client recently that pointed all vnet DNS to a box that just chucked everything back on-prem. Then they created forward zones with naked A records for every private endpoint.

#

It was horrible...

hot jetty Sep 13, 2023, 12:53 AM

#

nimble flicker You're just adding a redundant forwarder to the chain in that case. From custom ...

Only if those custom dns are running in Azure

nimble flicker Sep 13, 2023, 12:53 AM

#

Yep. Which, from the screenshot above, they are.

frosty compass Sep 13, 2023, 12:57 AM

#

Thanks for the help yall, I'll swing back to this post tmrw morning!

#Need some assistance with azure private endpoints