在 Azure Stack Hub 中使用 iDNSUse iDNS in Azure Stack Hub

iDNS 是一种 Azure Stack Hub 网络功能,可用于解析外部 DNS 名称(例如,https://www.bing.com)。它还可用于注册内部虚拟网络名称。iDNS is an Azure Stack Hub networking feature that enables you to resolve external DNS names (for example, https://www.bing.com.) It also allows you to register internal virtual network names. 如此一来,就可按名称(而非 IP 地址)解析同一虚拟网络上的虚拟机 (VM)。By doing so, you can resolve virtual machines (VMs) on the same virtual network by name rather than IP address. 使用此方法,不再需要提供自定义 DNS 服务器条目。This approach removes the need to provide custom DNS server entries. 有关 DNS 的详细信息,请参阅 Azure DNS 概述For more information about DNS, see the Azure DNS Overview.

iDNS 有什么作用?What does iDNS do?

使用 Azure Stack Hub 中的 iDNS 可以获得以下功能,而无需指定自定义 DNS 服务器条目:With iDNS in Azure Stack Hub, you get the following capabilities, without having to specify custom DNS server entries:

  • 适用于租户工作负荷的共享 DNS 名称解析服务。Shared DNS name resolution services for tenant workloads.
  • 适用于租户虚拟网络内的名称解析和 DNS 注册的权威 DNS 服务。Authoritative DNS service for name resolution and DNS registration within the tenant virtual network.
  • 从租户 VM 解析 Internet 名称的递归 DNS 服务。Recursive DNS service for resolution of internet names from tenant VMs. 租户不再需要指定自定义 DNS 条目,就可以解析 Internet 名称(例如,www.bing.com)。Tenants no longer need to specify custom DNS entries to resolve internet names (for example, www.bing.com.)

你仍然可以沿用自己的 DNS,也可以使用自定义 DNS 服务器。You can still bring your own DNS and use custom DNS servers. 但是,通过使用 iDNS,你可以解析 Internet DNS 名称并连接到同一虚拟网络中的其他 VM,而无需创建自定义 DNS 条目。However, by using iDNS, you can resolve internet DNS names and connect to other VMs in the same virtual network without needing to create custom DNS entries.

iDNS 不做什么?What doesn't iDNS do?

iDNS 不允许针对可从虚拟网络外部解析的名称创建 DNS 记录。iDNS doesn't allow you to create a DNS record for a name that can be resolved from outside the virtual network.

在 Azure 中,可以选择指定与公共 IP 地址关联的 DNS 名称标签。In Azure, you have the option of specifying a DNS name label that is associated with a public IP address. 你可以选择标签(前缀),但 Azure 会根据创建公共 IP 地址所在的区域选择后缀。You can choose the label (prefix), but Azure chooses the suffix, which is based on the region in which you create the public IP address.

DNS 名称标签示例

如上图所示,Azure 会在 DNS 中为 chinanorth.chinacloudapp.cn 区域下指定的 DNS 名称标签创建“A”记录。As the previous image shows, Azure will create an "A" record in DNS for the DNS name label specified under the zone chinanorth.chinacloudapp.cn. 前缀和后缀组合起来构成完全限定域名 (FQDN),此域名可以从公共 Internet 上的任何位置解析。The prefix and the suffix are combined to compose a fully qualified domain name (FQDN) that can be resolved from anywhere on the public Internet.

Azure Stack Hub 仅支持将 iDNS 用于内部名称注册,因此它无法执行以下操作:Azure Stack Hub only supports iDNS for internal name registration, so it can't do the following things:

  • 在现有的托管 DNS 区域(例如,local.azurestack.external)下创建 DNS 记录。Create a DNS record under an existing hosted DNS zone (for example, local.azurestack.external.)
  • 创建 DNS 区域(例如 Contoso.com)。Create a DNS zone (such as Contoso.com.)
  • 在你自己的自定义 DNS 区域下创建记录。Create a record under your own custom DNS zone.
  • 支持购买域名。Support the purchase of domain names.

演示 iDNS 的工作原理Demo of how iDNS works

虚拟网络中 VM 的所有主机名都作为 DNS 资源记录存储在同一区域,但是,在这些 VM 自有的唯一区间,这些主机名定义为 GUID,该 GUID 与作为 VM 部署目标的 SDN 基础结构中的 VNET ID 相关。All of the host names for VMs on Virtual Networks are stored as DNS Resource Records under the same zone, however under their own unique compartment defined as a GUID that correlates to the VNET ID in the SDN infrastructure that the VM was deployed against. 租户 VM 的完全限定域名 (FQDN) 由计算机名以及虚拟网络的 DNS 后缀字符串(采用 GUID 格式)组成。Tenant VM Fully Qualified Domain Names (FQDNs) consist of the computer name and the DNS suffix string for the Virtual Network, in GUID format.

以下简单实验演示了相关的工作原理。Following is a simple lab to demonstrate how this works. 我们在一个 VNet 中创建了 3 个 VM,并在另一个 VNet 中创建了另一个 VM:We've created 3 VMs on one VNet and another VM on a separate VNet:

VMVM vNetvNet 专用 IPPrivate IP 公共 IPPublic IP DNS 标签DNS Label
VM-A1VM-A1 VNetAVNetA 10.0.0.510.0.0.5 172.31.12.68172.31.12.68 VM-A1-Label.lnv1.cloudapp.azscss.externalVM-A1-Label.lnv1.cloudapp.azscss.external
VM-A2VM-A2 VNetAVNetA 10.0.0.610.0.0.6 172.31.12.76172.31.12.76 VM-A2-Label.lnv1.cloudapp.azscss.externalVM-A2-Label.lnv1.cloudapp.azscss.external
VM-A3VM-A3 VNetAVNetA 10.0.0.710.0.0.7 172.31.12.49172.31.12.49 VM-A3-Label.lnv1.cloudapp.azscss.externalVM-A3-Label.lnv1.cloudapp.azscss.external
VM-B1VM-B1 VNetBVNetB 10.0.0.410.0.0.4 172.31.12.57172.31.12.57 VM-B1-Label.lnv1.cloudapp.azscss.externalVM-B1-Label.lnv1.cloudapp.azscss.external
VNetVNet GUIDGUID DNS 后缀字符串DNS suffix string
VNetAVNetA e71e1db5-0a38-460d-8539-705457a4cf75e71e1db5-0a38-460d-8539-705457a4cf75 e71e1db5-0a38-460d-8539-705457a4cf75.internal.lnv1.azurestack.locale71e1db5-0a38-460d-8539-705457a4cf75.internal.lnv1.azurestack.local
VNetBVNetB e8a6e386-bc7a-43e1-a640-61591b5c76dde8a6e386-bc7a-43e1-a640-61591b5c76dd e8a6e386-bc7a-43e1-a640-61591b5c76dd.internal.lnv1.azurestack.locale8a6e386-bc7a-43e1-a640-61591b5c76dd.internal.lnv1.azurestack.local

可以执行一些名称解析测试,以更好地了解 iDNS 的工作原理:You can do some name resolution tests to better understand how iDNS works:

在 VM-A1 (Linux VM) 中:查找 VM-A2。From VM-A1 (Linux VM): Looking up VM-A2. 可以看到,已添加 VNetA 的 DNS 后缀,并且名称已解析为专用 IP:You can see that the DNS suffix for VNetA is added and the name is resolved to the Private IP:

carlos@VM-A1:~$ nslookup VM-A2
Server:         127.0.0.53
Address:        127.0.0.53#53
 
Non-authoritative answer:
Name:   VM-A2.e71e1db5-0a38-460d-8539-705457a4cf75.internal.lnv1.azurestack.local
Address: 10.0.0.6

在不提供 FQDN 的情况下查找 VM-A2-Label 将会失败,这在意料之中:Looking up VM-A2-Label without providing the FQDN fails, as expected:

carlos@VM-A1:~$ nslookup VM-A2-Label
Server:         127.0.0.53
Address:        127.0.0.53#53
 
** server can't find VM-A2-Label: SERVFAIL

如果提供 DNS 标签的 FQDN,则名称将解析为公共 IP:If you provide the FQDN for the DNS label, the name is resolved to the Public IP:

carlos@VM-A1:~$ nslookup VM-A2-Label.lnv1.cloudapp.azscss.external
Server:         127.0.0.53
Address:        127.0.0.53#53
 
Non-authoritative answer:
Name:   VM-A2-Label.lnv1.cloudapp.azscss.external
Address: 172.31.12.76

尝试解析 VM-B1(位于不同的 VNet 中)将会失败,因为此记录不在此区域中。Trying to resolve VM-B1 (which is from a different VNet) fails as this record does not exist on this zone.

carlos@caalcobi-vm4:~$ nslookup VM-B1
Server:         127.0.0.53
Address:        127.0.0.53#53
 
** server can't find VM-B1: SERVFAIL

使用 VM-B1 的 FQDN 没有作用,因为此记录来自另一个区域。Using the FQDN for VM-B1 doesn't help as this record is from a different zone.

carlos@VM-A1:~$ nslookup VM-B1.e8a6e386-bc7a-43e1-a640-61591b5c76dd.internal.lnv1.azurestack.local
Server:         127.0.0.53
Address:        127.0.0.53#53
 
** server can't find VM-B1.e8a6e386-bc7a-43e1-a640-61591b5c76dd.internal.lnv1.azurestack.local: SERVFAIL

如果使用 DNS 标签的 FQDN,则可成功解析:If you use the FQDN for the DNS label, then it resolves successfully:

carlos@VM-A1:~$ nslookup VM-B1-Label.lnv1.cloudapp.azscss.external
Server:         127.0.0.53
Address:        127.0.0.53#53
 
Non-authoritative answer:
Name:   VM-B1-Label.lnv1.cloudapp.azscss.external
Address: 172.31.12.57

在 VM-A3 (Windows VM) 中。From VM-A3 (Windows VM). 请注意权威与非权威应答之间的差异。Notice the difference between authoritative and non-authoritative answers.

内部记录:Internal records:

C:\Users\carlos>nslookup
Default Server:  UnKnown
Address:  168.63.129.16
 
> VM-A2
Server:  UnKnown
Address:  168.63.129.16
 
Name:    VM-A2.e71e1db5-0a38-460d-8539-705457�4cf75.internal.lnv1.azurestack.local
Address:  10.0.0.6

外部记录:External records:

> VM-A2-Label.lnv1.cloudapp.azscss.external
Server:  UnKnown
Address:  168.63.129.16
 
Non-authoritative answer:
Name:    VM-A2-Label.lnv1.cloudapp.azscss.external
Address:  172.31.12.76

概括而言,在以上内容中可以看到:In short, you can see from the above that:

  • 每个 VNet 具有自身的区域,其中包含所有专用 IP 地址的 A 记录,这些记录由 VM 名称和 VNet 的 DNS 后缀(其 GUID)组成。Each VNet has its own zone, containing A records for all private IP addresses, consisting of VM name and the DNS suffix of the VNet (which is its GUID).
    • <VM 名称>.<VNet GUID>.internal.<区域>.<Stack 内部 FQDN><vmname>.<vnetGUID>.internal.<region>.<stackinternalFQDN>
    • 此过程是自动完成的This is done automatically
  • 如果使用公共 IP 地址,则也可以为其创建 DNS 标签。If you use Public IP addresses, you can also create DNS labels for them. 这些地址的解析方式类似于其他任何外部地址。These are resolved like any other external address.
  • iDNS 服务器是其内部 DNS 区域的权威服务器,并且还在租户 VM 尝试连接到外部资源时,充当公共名称的解析器。iDNS servers are the authoritative servers for their internal DNS zones, and also act as a resolver for public names when tenant VMs attempt to connect to external resources. 如果存在对外部资源的查询,则 iDNS 服务器会将请求转发到权威 DNS 服务器进行解析。If there is a query for an external resource, then iDNS servers forward the request to authoritative DNS servers to resolve.

从实验结果中可以看到,你可以对使用的 IP 进行控制。As you can see from the lab results, you have control over what IP is used. 如果使用 VM 名称,则会获得专用 IP 地址;如果使用 DNS 标签,则会获得公共 IP 地址。If you use the VM name, you will get the private IP address and if you use the DNS label you get the public IP address.

后续步骤Next steps

使用 Azure Stack Hub 中的 DNSUsing DNS in Azure Stack Hub