Azure-测试Azure 专用 DNS

概述

Azure 专用 DNS 为虚拟网络提供可靠且安全的 DNS 服务。 Azure 专用 DNS 可管理并解析虚拟网络中的域名，使用户无需配置自定义 DNS 解决方案。 借助专用 DNS 区域，可在部署期间使用自定义域名而不是 Azure 提供的名称。 使用自定义域名可帮助用户定制最适合组织需求的虚拟网络体系结构。 它为虚拟网络和连接的虚拟网络中的虚拟机 (VM) 提供名称解析。

除此之外，还可以通过水平分割视图配置区域名称，从而允许专用和公用 DNS 区域共享名称。

若要从虚拟网络解析专用 DNS 区域的记录，必须将虚拟网络与该区域链接。 链接的虚拟网络具有完全访问权限，可以解析在专用区域中发布的所有 DNS 记录。
用户还可以在虚拟网络链路上启用自动注册。 如果在虚拟网络链路上启用自动注册，则会在专用区域注册该虚拟网络中虚拟机的 DNS 记录。 启用自动注册后，每当创建虚拟机、更改其 IP 地址或删除虚拟机时，Azure DNS 都会更新区域记录。

使用限制

资源	限制
每个订阅的专用 DNS 区域数	1000
每个专用 DNS 区域的记录集数	25000
专用 DNS 区域的每个记录集的记录数	20
每个专用 DNS 区域的虚拟网络链接数	1000
在启用了自动注册的情况下，每个专用 DNS 区域的虚拟网络链接数	100
在启用了自动注册的情况下，虚拟网络可以链接到的专用 DNS 区域数	1
虚拟网络可以链接的专用 DNS 区域数	1000
虚拟机每秒可发送到 Azure DNS 解析程序的 DNS 查询数	1000 1
每个虚拟机排队（等待响应）的最大 DNS 查询数	200 1

Tips

• 最好不要将 .local 域用于专用 DNS 区域 。 并非所有操作系统都支持此功能
• 专用 DNS 区域只能从指定的虚拟网络中进行解析
• 支持在跨 Azure 区域的虚拟网络之间进行 DNS 解析
• 删除链接的虚拟网络而不先将其从专用区域中取消链接，则删除操作将会成功，并且会自动清除对 DNS 区域的链接
• 链接的虚拟网络中虚拟机上的 DNS 后缀将保留为 Azure 提供的默认后缀（“*.internal.cloudapp.net”）,但可手动修改

Lab

使用Azure CLI创建专用 DNS 区域。

创建资源组

首先，创建一个资源组：

[root@Alma ~]# az group create --name TestDNSResourceGroup --location "East Asia"
{
  "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/TestDNSResourceGroup",
  "location": "eastasia",
  "managedBy": null,
  "name": "TestDNSResourceGroup",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": null,
  "type": "Microsoft.Resources/resourceGroups"
}

创建专用 DNS 区域

创建一个名为“TestDNSVNet”的虚拟网络。

[root@Alma ~]# az network vnet create \
>   --name TestDNSVNet \
>   --resource-group TestDNSResourceGroup \
>   --location eastasia \
>   --address-prefix 10.10.0.0/16 \
>   --subnet-name backendSubnet \
>   --subnet-prefixes 10.10.0.0/24
{
  "newVNet": {
    "addressSpace": {
      "addressPrefixes": [
        "10.10.0.0/16"
      ]
    },
    "bgpCommunities": null,
    "ddosProtectionPlan": null,
    "dhcpOptions": {
      "dnsServers": []
    },
    "enableDdosProtection": false,
    "enableVmProtection": null,
    "encryption": null,
    "etag": "W/\"6756a6ce-acd7-434a-bc2b-410835230281\"",
    "extendedLocation": null,
    "flowTimeoutInMinutes": null,
    "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/TestDNSResourceGroup/providers/Microsoft.Network/virtualNetworks/TestDNSVNet",
    "ipAllocations": null,
    "location": "eastasia",
    "name": "TestDNSVNet",
    "provisioningState": "Succeeded",
    "resourceGroup": "TestDNSResourceGroup",
    "resourceGuid": "2e851c3c-e190-41dd-8fb3-1157b4bc2a98",
    "subnets": [
      {
        "addressPrefix": "10.10.0.0/24",
        "addressPrefixes": null,
        "applicationGatewayIpConfigurations": null,
        "delegations": [],
        "etag": "W/\"6756a6ce-acd7-434a-bc2b-410835230281\"",
        "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/TestDNSResourceGroup/providers/Microsoft.Network/virtualNetworks/TestDNSVNet/subnets/backendSubnet",
        "ipAllocations": null,
        "ipConfigurationProfiles": null,
        "ipConfigurations": null,
        "name": "backendSubnet",
        "natGateway": null,
        "networkSecurityGroup": null,
        "privateEndpointNetworkPolicies": "Enabled",
        "privateEndpoints": null,
        "privateLinkServiceNetworkPolicies": "Enabled",
        "provisioningState": "Succeeded",
        "purpose": null,
        "resourceGroup": "TestDNSResourceGroup",
        "resourceNavigationLinks": null,
        "routeTable": null,
        "serviceAssociationLinks": null,
        "serviceEndpointPolicies": null,
        "serviceEndpoints": null,
        "type": "Microsoft.Network/virtualNetworks/subnets"
      }
    ],
    "tags": {},
    "type": "Microsoft.Network/virtualNetworks",
    "virtualNetworkPeerings": []
  }
}

然后，它在 TestDNSResourceGroup 资源组中创建一个名为 etaon.com 的 DNS 区域

[root@Alma ~]# az network private-dns zone create -g TestDNSResourceGroup \
>   -n etaon.com
{
  "etag": "05fdf126-534d-4dcf-a54d-f7776b47477d",
  "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/testdnsresourcegroup/providers/Microsoft.Network/privateDnsZones/etaon.com",
  "location": "global",
  "maxNumberOfRecordSets": 25000,
  "maxNumberOfVirtualNetworkLinks": 1000,
  "maxNumberOfVirtualNetworkLinksWithRegistration": 100,
  "name": "etaon.com",
  "numberOfRecordSets": 1,
  "numberOfVirtualNetworkLinks": 0,
  "numberOfVirtualNetworkLinksWithRegistration": 0,
  "provisioningState": "Succeeded",
  "resourceGroup": "testdnsresourcegroup",
  "tags": null,
  "type": "Microsoft.Network/privateDnsZones"
}

将该 DNS 区域链接到 TestDNSVnet 虚拟网络，并启用自动注册

[root@Alma ~]# az network private-dns link vnet create -g TestDNSResourceGroup -n MyDNSLink \
>    -z etaon.com -v TestDNSVNet -e true
{
  "etag": "\"ec00e355-0000-0100-0000-61c4578e0000\"",
  "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/testdnsresourcegroup/providers/Microsoft.Network/privateDnsZones/etaon.com/virtualNetworkLinks/mydnslink",
  "location": "global",
  "name": "mydnslink",
  "provisioningState": "Succeeded",
  "registrationEnabled": true,
  "resourceGroup": "testdnsresourcegroup",
  "tags": null,
  "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
  "virtualNetwork": {
    "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/TestDNSResourceGroup/providers/Microsoft.Network/virtualNetworks/TestDNSVNet",
    "resourceGroup": "TestDNSResourceGroup"
  },
  "virtualNetworkLinkState": "Completed"
}

查看Azure DNS 专用区域

[root@Alma ~]# az network private-dns zone list -g testdnsresourcegroup
[
  {
    "etag": "05fdf126-534d-4dcf-a54d-f7776b47477d",
    "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/testdnsresourcegroup/providers/Microsoft.Network/privateDnsZones/etaon.com",
    "location": "global",
    "maxNumberOfRecordSets": 25000,
    "maxNumberOfVirtualNetworkLinks": 1000,
    "maxNumberOfVirtualNetworkLinksWithRegistration": 100,
    "name": "etaon.com",
    "numberOfRecordSets": 1,
    "numberOfVirtualNetworkLinks": 0,
    "numberOfVirtualNetworkLinksWithRegistration": 0,
    "provisioningState": "Succeeded",
    "resourceGroup": "testdnsresourcegroup",
    "tags": null,
    "type": "Microsoft.Network/privateDnsZones"
  }
]

创建测试虚拟机

[root@Alma ~]# az vm create \
>  -n myVM01 \
>  --admin-username AzureAdmin \
>  -g TestDNSResourceGroup \
>  -l eastasia \
>  --subnet backendSubnet \
>  --vnet-name TestDNSVnet \
>  --nsg NSG01 \
>  --nsg-rule RDP \
>  --image win2016datacenter
Admin Password: 
Confirm Admin Password: 
It is recommended to use parameter "--public-ip-sku Standard" to create new VM with Standard public IP. Please note that the default public IP used for VM creation will be changed from Basic to Standard in the future.
{
  "fqdns": "",
  "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/TestDNSResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM01",
  "location": "eastasia",
  "macAddress": "00-0D-3A-80-A6-F3",
  "powerState": "VM running",
  "privateIpAddress": "10.10.0.4",
  "publicIpAddress": "20.187.110.140",
  "resourceGroup": "TestDNSResourceGroup",
  "zones": ""
}

IP：10.10.0.4/20.187.110.140

[root@Alma ~]#  az vm create \
> -g TestDNSResourceGroup \
> --location eastasia \
> --name myVM02 \
> --image UbuntuLTS \
> --admin-username azureuser \
> --generate-ssh-keys \
> --verbose
SSH key files '/root/.ssh/id_rsa' and '/root/.ssh/id_rsa.pub' have been generated under ~/.ssh to allow SSH access to the VM. If using machines without permanent storage, back up your keys to a safe location.
It is recommended to use parameter "--public-ip-sku Standard" to create new VM with Standard public IP. Please note that the default public IP used for VM creation will be changed from Basic to Standard in the future.
{
  "fqdns": "",
  "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/TestDNSResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM02",
  "location": "eastasia",
  "macAddress": "00-0D-3A-81-E1-71",
  "powerState": "VM running",
  "privateIpAddress": "10.10.0.5",
  "publicIpAddress": "20.187.76.82",
  "resourceGroup": "TestDNSResourceGroup",
  "zones": ""
}
Command ran in 38.435 seconds (init: 0.099, invoke: 38.336)

IP：10.10.0.5/20.187.76.82

由于该Azure DNS Zone配置了自动注册，会生成基于VM名字的记录:

[root@Alma ~]# az network private-dns record-set list   -g TestDNSResourceGroup -z etaon.com
[
  {
    "aRecords": null,
    "aaaaRecords": null,
    "cnameRecord": null,
    "etag": "64a99f5b-31ce-44b1-b013-89ddf6d6dc1a",
    "fqdn": "etaon.com.",
    "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/testdnsresourcegroup/providers/Microsoft.Network/privateDnsZones/etaon.com/SOA/@",
    "isAutoRegistered": false,
    "metadata": null,
    "mxRecords": null,
    "name": "@",
    "ptrRecords": null,
    "resourceGroup": "testdnsresourcegroup",
    "soaRecord": {
      "email": "azureprivatedns-host.microsoft.com",
      "expireTime": 2419200,
      "host": "azureprivatedns.net",
      "minimumTtl": 10,
      "refreshTime": 3600,
      "retryTime": 300,
      "serialNumber": 1
    },
    "srvRecords": null,
    "ttl": 3600,
    "txtRecords": null,
    "type": "Microsoft.Network/privateDnsZones/SOA"
  },
  {
    "aRecords": [
      {
        "ipv4Address": "10.10.0.4"
      }
    ],
    "aaaaRecords": null,
    "cnameRecord": null,
    "etag": "24c73355-1591-450e-bf72-5a62e257f8f0",
    "fqdn": "myvm01.etaon.com.",
    "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/testdnsresourcegroup/providers/Microsoft.Network/privateDnsZones/etaon.com/A/myvm01",
    "isAutoRegistered": true,
    "metadata": null,
    "mxRecords": null,
    "name": "myvm01",
    "ptrRecords": null,
    "resourceGroup": "testdnsresourcegroup",
    "soaRecord": null,
    "srvRecords": null,
    "ttl": 10,
    "txtRecords": null,
    "type": "Microsoft.Network/privateDnsZones/A"
  },
  {
    "aRecords": [
      {
        "ipv4Address": "10.10.0.5"
      }
    ],
    "aaaaRecords": null,
    "cnameRecord": null,
    "etag": "2e20d92f-fbcd-4a03-ae71-b15d1bd5ef9f",
    "fqdn": "myvm02.etaon.com.",
    "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/testdnsresourcegroup/providers/Microsoft.Network/privateDnsZones/etaon.com/A/myvm02",
    "isAutoRegistered": true,
    "metadata": null,
    "mxRecords": null,
    "name": "myvm02",
    "ptrRecords": null,
    "resourceGroup": "testdnsresourcegroup",
    "soaRecord": null,
    "srvRecords": null,
    "ttl": 10,
    "txtRecords": null,
    "type": "Microsoft.Network/privateDnsZones/A"
  }
]

“aRecords”: [
{
“ipv4Address”: “10.10.0.4”
}
],
…
“fqdn”: “myvm01.etaon.com.”

“aRecords”: [
{
“ipv4Address”: “10.10.0.5”
}
],
…
“fqdn”: “myvm02.etaon.com.”,

增加静态DNS A记录

使用 az network private-dns record-set [record type] add-record 命令添加 A 记录

[root@Alma ~]# az network private-dns record-set a add-record \
>   -g TestDNSResourceGroup \
>   -z etaon.com \
>   -n db \
>   -a 10.10.0.4
{
  "aRecords": [
    {
      "ipv4Address": "10.10.0.4"
    }
  ],
  "etag": "60933e87-d5ec-4416-8ad7-40996f5ead53",
  "fqdn": "db.etaon.com.",
  "id": "/subscriptions/14adb214-7b29-422a-ac8a-df2af1e51201/resourceGroups/testdnsresourcegroup/providers/Microsoft.Network/privateDnsZones/etaon.com/A/db",
  "isAutoRegistered": false,
  "metadata": null,
  "name": "db",
  "resourceGroup": "testdnsresourcegroup",
  "ttl": 3600,
  "type": "Microsoft.Network/privateDnsZones/A"
}

检测

登录到myvm02

[root@Alma ~]# ssh azureuser@20.187.76.82
Welcome to Ubuntu 18.04.6 LTS (GNU/Linux 5.4.0-1064-azure x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Thu Dec 23 11:42:33 UTC 2021

  System load:  0.0               Processes:           108
  Usage of /:   4.7% of 28.90GB   Users logged in:     0
  Memory usage: 5%                IP address for eth0: 10.10.0.5
  Swap usage:   0%


0 updates can be applied immediately.

New release '20.04.3 LTS' available.
Run 'do-release-upgrade' to upgrade to it.


Last login: Thu Dec 23 11:35:47 2021 from 101.229.116.208
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

查看DNS Server 信息

azureuser@myVM02:~$ cat /etc/resolv.conf 
# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "systemd-resolve --status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0
search hqoikluq2houdd3tcfl1jpbkta.hx.internal.cloudapp.net

查询内部记录

azureuser@myVM02:~$ `dig myvm01.etaon.com`

; <<>> DiG 9.11.3-1ubuntu1.16-Ubuntu <<>> myvm01.etaon.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47678
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;myvm01.etaon.com.              IN      A

;; ANSWER SECTION:
`myvm01.etaon.com.       10      IN      A       10.10.0.4`

;; Query time: 5 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Thu Dec 23 11:42:44 UTC 2021
;; MSG SIZE  rcvd: 61

azureuser@myVM02:~$ `dig myvm02.etaon.com`

; <<>> DiG 9.11.3-1ubuntu1.16-Ubuntu <<>> myvm02.etaon.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26923
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;myvm02.etaon.com.              IN      A

;; ANSWER SECTION:
`myvm02.etaon.com.       10      IN      A       10.10.0.5`

;; Query time: 5 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Thu Dec 23 11:42:49 UTC 2021
;; MSG SIZE  rcvd: 61

azureuser@myVM02:~$ `dig db.etaon.com`

; <<>> DiG 9.11.3-1ubuntu1.16-Ubuntu <<>> db.etaon.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23728
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;db.etaon.com.                  IN      A

;; ANSWER SECTION:
`db.etaon.com.           1800    IN      A       10.10.0.4`

;; Query time: 4 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Thu Dec 23 11:42:57 UTC 2021
;; MSG SIZE  rcvd: 57

查询外网记录

azureuser@myVM02:~$ nslookup cisco.com
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   cisco.com
Address: 72.163.4.185
Name:   cisco.com
Address: 2001:420:1101:1::185

清理资源

最后，可以通过删除 TestDNSResourceGroup 资源组来删除在本实验中创建的资源

[root@Alma ~]# az group delete --name TestDNSResourceGroup
Are you sure you want to perform this operation? (y/n): y

本实验使用命令

• az group create --name TestDNSResourceGroup --location “East Asia”
• az network vnet create \
  –name TestDNSVNet \
  –resource-group TestDNSResourceGroup \
  –location eastasia \
  –address-prefix 10.10.0.0/16 \
  –subnet-name backendSubnet \
  –subnet-prefixes 10.10.0.0/24
• az network private-dns zone create \
  -g TestDNSResourceGroup \
  -n etaon.com
• az network private-dns link vnet create \
  -g TestDNSResourceGroup -n MyDNSLink \
  -z etaon.com -v TestDNSVNet -e true
• az vm create \
  -n myVM01 \
  –admin-username AzureAdmin \
  -g TestDNSResourceGroup \
  -l eastasia \
  –subnet backendSubnet \
  –vnet-name TestDNSVnet \
  –nsg NSG01 \
  –nsg-rule RDP \
  –image win2016datacenter
• az vm create \
  -g TestDNSResourceGroup \
  –location eastasia \
  –name myVM02 \
  –image UbuntuLTS \
  –admin-username azureuser \
  –generate-ssh-keys \
  –verbose
• az network private-dns record-set a add-record \
  -g TestDNSResourceGroup \
  -z etaon.com \
  -n db \
  -a 10.10.0.4
• az network private-dns record-set list \
  -g TestDNSResourceGroup \
  -z etaon.com