快速入门:使用 Azure PowerShell 创建 Azure 专用 DNS 区域Quickstart: Create an Azure private DNS zone using Azure PowerShell

本文将逐步引导你完成使用 PowerShell 创建第一个专用 DNS 区域和记录的步骤。This article walks you through the steps to create your first private DNS zone and record using Azure PowerShell.

备注

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

DNS 区域用来托管某个特定域的 DNS 记录。A DNS zone is used to host the DNS records for a particular domain. 若要开始在 Azure DNS 中托管域,需要为该域名创建 DNS 区域。To start hosting your domain in Azure DNS, you need to create a DNS zone for that domain name. 随后会在此 DNS 区域内为每个 DNS 记录创建域。Each DNS record for your domain is then created inside this DNS zone. 若要向虚拟网络发布专用 DNS 区域,请指定一个列表,其中包含允许在区域中解析记录的虚拟网络。To publish a private DNS zone to your virtual network, you specify the list of virtual networks that are allowed to resolve records within the zone. 这些虚拟网络称为链接的虚拟网络。 These are called linked virtual networks. 启用自动注册后,Azure DNS 还会在创建虚拟机、更改其 IP 地址或删除虚拟机时更新区域记录。When autoregistration is enabled, Azure DNS also updates the zone records whenever a virtual machine is created, changes its' IP address, or is deleted.

在本文中,学习如何:In this article, you learn how to:

  • 创建专用 DNS 区域Create a private DNS zone
  • 创建测试虚拟机Create test virtual machines
  • 创建额外的 DNS 记录Create an additional DNS record
  • 测试专用区域Test the private zone

如果没有 Azure 订阅,可在开始前创建一个 1 元人民币试用帐户If you don’t have an Azure subscription, create a 1rmb trial account before you begin.

如果你愿意,可以使用 Azure CLI 完成本快速入门中的步骤。If you prefer, you can complete this quickstart using Azure CLI.

创建资源组Create the resource group

首先,创建一个资源组,使之包含 DNS 区域:First, create a resource group to contain the DNS zone:

New-AzResourceGroup -name MyAzureResourceGroup -location "chinaeast2"

创建专用 DNS 区域Create a private DNS zone

通过使用 New-AzPrivateDnsZone cmdlet 创建 DNS 区域。A DNS zone is created by using the New-AzPrivateDnsZone cmdlet.

以下示例创建一个名为“myAzureVNet”的虚拟网络 。The following example creates a virtual network named myAzureVNet. 然后,它在 MyAzureResourceGroup 资源组中创建一个名为 private.contoso.com 的 DNS 区域,将该 DNS 区域链接到 MyAzureVnet 虚拟网络,并启用自动注册。Then it creates a DNS zone named private.contoso.com in the MyAzureResourceGroup resource group, links the DNS zone to the MyAzureVnet virtual network, and enables automatic registration.

Install-Module -Name Az.PrivateDns -force

$backendSubnet = New-AzVirtualNetworkSubnetConfig -Name backendSubnet -AddressPrefix "10.2.0.0/24"
$vnet = New-AzVirtualNetwork `
  -ResourceGroupName MyAzureResourceGroup `
  -Location chinaeast2 `
  -Name myAzureVNet `
  -AddressPrefix 10.2.0.0/16 `
  -Subnet $backendSubnet

$zone = New-AzPrivateDnsZone -Name private.contoso.com -ResourceGroupName MyAzureResourceGroup

$link = New-AzPrivateDnsVirtualNetworkLink -ZoneName private.contoso.com `
  -ResourceGroupName MyAzureResourceGroup -Name "mylink" `
  -VirtualNetworkId $vnet.id -EnableRegistration

如果要创建仅用于名称解析的区域(不自动注册主机名),则可以省略 -EnableRegistration 参数。If you want to create a zone just for name resolution (no automatic hostname registration), you can omit the -EnableRegistration parameter.

列出 Azure DNS 专用区域List DNS private zones

通过省略 Get-AzPrivateDnsZone 中的区域名称,可以枚举资源组中的所有区域。By omitting the zone name from Get-AzPrivateDnsZone, you can enumerate all zones in a resource group. 此操作将返回区域对象的数组。This operation returns an array of zone objects.

$zones = Get-AzPrivateDnsZone -ResourceGroupName MyAzureResourceGroup
$zones

通过省略 Get-AzPrivateDnsZone 的区域名和资源组名,可枚举 Azure 订阅中的所有区域。By omitting both the zone name and the resource group name from Get-AzPrivateDnsZone, you can enumerate all zones in the Azure subscription.

$zones = Get-AzPrivateDnsZone
$zones

创建测试虚拟机Create the test virtual machines

现在,创建两台虚拟机,以便可以测试专用 DNS 区域:Now, create two virtual machines so you can test your private DNS zone:

New-AzVm `
    -ResourceGroupName "myAzureResourceGroup" `
    -Name "myVM01" `
    -Location "China East 2" `
    -subnetname backendSubnet `
    -VirtualNetworkName "myAzureVnet" `
    -addressprefix 10.2.0.0/24 `
    -OpenPorts 3389

New-AzVm `
    -ResourceGroupName "myAzureResourceGroup" `
    -Name "myVM02" `
    -Location "China East 2" `
    -subnetname backendSubnet `
    -VirtualNetworkName "myAzureVnet" `
    -addressprefix 10.2.0.0/24 `
    -OpenPorts 3389

完成此设置可能需要几分钟时间。This will take a few minutes to complete.

创建额外的 DNS 记录Create an additional DNS record

可以使用 New-AzPrivateDnsRecordSet cmdlet 创建记录集。You create record sets by using the New-AzPrivateDnsRecordSet cmdlet. 下面的示例在 DNS 区域 private.contoso.com 的资源组 MyAzureResourceGroup 中创建相对名称为 db 的一个记录。The following example creates a record with the relative name db in the DNS Zone private.contoso.com, in resource group MyAzureResourceGroup. 记录集的完全限定名称为 db.private.contoso.comThe fully qualified name of the record set is db.private.contoso.com. 记录类型为“A”,IP 地址为“10.2.0.4”,TTL 为 3600 秒。The record type is "A", with IP address "10.2.0.4", and the TTL is 3600 seconds.

New-AzPrivateDnsRecordSet -Name db -RecordType A -ZoneName private.contoso.com `
   -ResourceGroupName MyAzureResourceGroup -Ttl 3600 `
   -PrivateDnsRecords (New-AzPrivateDnsRecordConfig -IPv4Address "10.2.0.4")

查看 DNS 记录View DNS records

若要列出区域中的 DNS 记录,请运行:To list the DNS records in your zone, run:

Get-AzPrivateDnsRecordSet -ZoneName private.contoso.com -ResourceGroupName MyAzureResourceGroup

测试专用区域Test the private zone

现在,可以测试 private.contoso.com 专用区域的名称解析。Now you can test the name resolution for your private.contoso.com private zone.

将 VM 配置为允许入站 ICMPConfigure VMs to allow inbound ICMP

可以使用 ping 命令来测试名称解析。You can use the ping command to test name resolution. 因此,在两台虚拟机上都将防火墙配置为允许入站 ICMP 数据包。So, configure the firewall on both virtual machines to allow inbound ICMP packets.

  1. 连接到 myVM01,使用管理员权限打开 Windows PowerShell 窗口。Connect to myVM01, and open a Windows PowerShell window with administrator privileges.

  2. 运行以下命令:Run the following command:

    New-NetFirewallRule –DisplayName "Allow ICMPv4-In" –Protocol ICMPv4
    

针对 myVM02 重复上述操作。Repeat for myVM02.

按名称对 VM 执行 ping 命令Ping the VMs by name

  1. 从 myVM02 Windows PowerShell 命令提示符下,使用自动注册的主机名对 myVM01 执行 ping 命令:From the myVM02 Windows PowerShell command prompt, ping myVM01 using the automatically registered host name:

    ping myVM01.private.contoso.com
    

    应当会看到与以下内容类似的输出:You should see output that looks similar to this:

    PS C:\> ping myvm01.private.contoso.com
    
    Pinging myvm01.private.contoso.com [10.2.0.4] with 32 bytes of data:
    Reply from 10.2.0.4: bytes=32 time<1ms TTL=128
    Reply from 10.2.0.4: bytes=32 time=1ms TTL=128
    Reply from 10.2.0.4: bytes=32 time<1ms TTL=128
    Reply from 10.2.0.4: bytes=32 time<1ms TTL=128
    
    Ping statistics for 10.2.0.4:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 0ms, Maximum = 1ms, Average = 0ms
    PS C:\>
    
  2. 现在,对之前创建的 db 名称执行 ping 命令:Now ping the db name you created previously:

    ping db.private.contoso.com
    

    应当会看到与以下内容类似的输出:You should see output that looks similar to this:

    PS C:\> ping db.private.contoso.com
    
    Pinging db.private.contoso.com [10.2.0.4] with 32 bytes of data:
    Reply from 10.2.0.4: bytes=32 time<1ms TTL=128
    Reply from 10.2.0.4: bytes=32 time<1ms TTL=128
    Reply from 10.2.0.4: bytes=32 time<1ms TTL=128
    Reply from 10.2.0.4: bytes=32 time<1ms TTL=128
    
    Ping statistics for 10.2.0.4:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milliseconds:
        Minimum = 0ms, Maximum = 0ms, Average = 0ms
    PS C:\>
    

删除所有资源Delete all resources

不再需要时,可以通过删除 MyAzureResourceGroup 资源组来删除在本文中创建的资源。When no longer needed, delete the MyAzureResourceGroup resource group to delete the resources created in this article.

Remove-AzResourceGroup -Name MyAzureResourceGroup

后续步骤Next steps