Azure 防火墙策略 DNS 设置(预览)Azure Firewall policy DNS settings (preview)


Azure 防火墙 DNS 设置目前处于公共预览状态。Azure Firewall DNS settings is currently in public preview. 此预览版在提供时没有附带服务级别协议,不建议将其用于生产工作负荷。This preview version is provided without a service level agreement, and it's not recommended for production workloads. 某些功能可能不受支持或者受限。Certain features might not be supported or might have constrained capabilities. 有关详细信息,请参阅适用于 Azure 预览版的补充使用条款For more information, see Supplemental Terms of Use for Azure Previews.

可以为 Azure 防火墙策略配置自定义 DNS 服务器并启用 DNS 代理。You can configure a custom DNS server and enable DNS proxy for Azure Firewall policies. 可以在部署防火墙时配置这些设置,或者稍后从“DNS 设置”页进行配置。You can configure these settings when you deploy the firewall or later from the DNS settings page.

DNS 服务器DNS servers

DNS 服务器维护域名并将它解析为 IP 地址。A DNS server maintains and resolves domain names to IP addresses. 默认情况下,Azure 防火墙将 Azure DNS 用于名称解析。By default, Azure Firewall uses Azure DNS for name resolution. 通过“DNS 服务器”设置,你可以配置自己的 DNS 服务器来用于 Azure 防火墙名称解析。The DNS server setting lets you configure your own DNS servers for Azure Firewall name resolution. 可以配置一台或多台服务器。You can configure a single or multiple servers.

配置自定义 DNS 服务器Configure custom DNS servers

  1. 选择你的防火墙策略。Select your firewall policy.
  2. 在“设置”下,选择“DNS 设置” 。Under Settings, select DNS Settings.
  3. 在“DNS 服务器”下,可以键入或添加之前在虚拟网络中指定的现有 DNS 服务器。Under DNS servers, you can type or add existing DNS servers that have been previously specified in your Virtual Network.
  4. 选择“保存” 。Select Save.
  5. 防火墙现在将 DNS 流量定向到指定的 DNS 服务器以进行名称解析。The firewall now directs DNS traffic to the specified DNS server(s) for name resolution.

DNS 代理(预览)DNS proxy (preview)

可以对 Azure 防火墙进行配置来充当 DNS 代理。You can configure Azure Firewall to act as a DNS proxy. DNS 代理充当从客户端虚拟机到 DNS 服务器的 DNS 请求的中介。A DNS proxy acts as an intermediary for DNS requests from client virtual machines to a DNS server. 如果配置自定义 DNS 服务器,应启用 DNS 代理以避免 DNS 解析不匹配,并在网络规则中启用 FQDN 筛选。If you configure a custom DNS server, you should enable DNS proxy to avoid DNS resolution mismatch, and enable FQDN filtering in network rules.

如果未启用 DNS 代理,来自客户端的 DNS 请求可能会在不同的时间传到 DNS 服务器,或者返回与防火墙不同的响应。If you don't enable DNS proxy, DNS requests from the client may travel to a DNS server at a different time or return a different response compared to that of the firewall. DNS 代理将 Azure 防火墙放置在客户端请求的路径中以避免不一致。DNS proxy puts Azure Firewall in the path of the client requests to avoid inconsistency.

配置 DNS 代理需要三个步骤:DNS Proxy configuration requires three steps:

  1. 在 Azure 防火墙 DNS 设置中启用 DNS 代理。Enable DNS proxy in Azure Firewall DNS settings.
  2. (可选)配置自定义 DNS 服务器或使用提供的默认设置。Optionally configure your custom DNS server or use the provided default.
  3. 最后,必须在虚拟网络 DNS 服务器设置中将 Azure 防火墙的专用 IP 地址配置为自定义 DNS 地址。Finally, you must configure the Azure Firewall’s private IP address as a Custom DNS address in your virtual network DNS server settings. 这可确保 DNS 流量定向到 Azure 防火墙。This ensures DNS traffic is directed to Azure Firewall.

配置 DNS 代理(预览)Configure DNS proxy (preview)

若要配置 DNS 代理,必须将你的虚拟网络 DNS 服务器设置配置为使用防火墙专用 IP 地址。To configure DNS proxy, you must configure your virtual network DNS servers setting to use the firewall private IP address. 然后,在 Azure 防火墙策略“DNS 设置”中启用 DNS 代理。Then, enable DNS Proxy in Azure Firewall policy DNS settings.

配置虚拟网络 DNS 服务器Configure virtual network DNS servers

  1. 选择 DNS 流量将通过 Azure 防火墙路由的虚拟网络。Select the virtual network where the DNS traffic will be routed through the Azure Firewall.
  2. 在“设置”下,选择“DNS 服务器”。 Under Settings, select DNS servers.
  3. 在“DNS 服务器”下,选择“自定义” 。Select Custom under DNS servers.
  4. 输入防火墙的专用 IP 地址。Enter the firewall’s private IP address.
  5. 选择“保存” 。Select Save.

启用 DNS 代理(预览)Enable DNS proxy (preview)

  1. 选择你的 Azure 防火墙策略。Select your Azure Firewall policy.
  2. 在“设置”下,选择“DNS 设置” 。Under Settings, select DNS settings.
  3. 默认情况下,“DNS 代理”已禁用。By default, DNS Proxy is disabled. 启用后,防火墙会在端口 53 上进行侦听,并将 DNS 请求转发到配置的 DNS 服务器。When enabled, the firewall listens on port 53 and forwards DNS requests to the configured DNS servers.
  4. 查看“DNS 服务器”配置以确保设置适用于你的环境。Review the DNS servers configuration to make sure that the settings are appropriate for your environment.
  5. 选择“保存”。Select Save.

后续步骤Next steps

网络规则中的 FQDN 筛选FQDN filtering in network rules