Azure 专用终结点 DNS 配置Azure Private Endpoint DNS configuration

请务必正确配置 DNS 设置,以便将专用终结点 IP 地址解析为连接字符串的完全限定的域名 (FQDN)。It's important to correctly configure your DNS settings to resolve the private endpoint IP address to the fully qualified domain name (FQDN) of the connection string.

现有的 Azure 服务可能已具有公共终结点的 DNS 配置。Existing Azure services might already have a DNS configuration for a public endpoint. 必须替代此配置才能使用专用终结点进行连接。This configuration must be overridden to connect using your private endpoint.

与专用终结点关联的网络接口包含配置 DNS 所需的信息。The network interface associated with the private endpoint contains the information to configure your DNS. 网络接口信息包括专用链接资源的 FQDN 和专用 IP 地址。The network interface information includes FQDN and private IP addresses for your private link resource.

可使用以下选项来配置专用终结点的 DNS 设置:You can use the following options to configure your DNS settings for private endpoints:

  • 使用主机文件(仅建议用于测试)Use the host file (only recommended for testing). 可以使用虚拟机上的主机文件来替代 DNS。You can use the host file on a virtual machine to override the DNS.
  • 使用专用 DNS 区域Use a private DNS zone. 你可使用专用 DNS 区域来替代专用终结点的 DNS 解析。You can use private DNS zones to override the DNS resolution for a private endpoint. 可将专用 DNS 区域链接到虚拟网络,以解析特定的域。A private DNS zone can be linked to your virtual network to resolve specific domains.
  • 使用 DNS 转发器(可选)Use your DNS forwarder (optional). 你可使用 DNS 转发器来替代专用链接资源的 DNS 解析。You can use your DNS forwarder to override the DNS resolution for a private link resource. 创建 DNS 转发规则,以在虚拟网络中托管的 DNS 服务器上使用专用 DNS 区域。Create a DNS forwarding rule to use a private DNS zone on your DNS server hosted in a virtual network.

重要

不建议替代正在用于解析公共终结点的区域。Is not recommended to override a zone that's actively in use to resolve public endpoints. 在不 DNS 转发到公共 DNS 的情况下,与资源的连接无法正确解析。Connections to resources won't be able to resolve correctly without DNS forwarding to the public DNS. 若要避免出现问题,请创建不同的域名,或对以下每个服务采用建议的名称。To avoid issues, create a different domain name or follow the suggested name for each service below.

Azure 服务 DNS 区域配置Azure services DNS zone configuration

Azure 将在公共 DNS 上创建一个规范名称 DNS 记录 (CNAME)。Azure creates a canonical name DNS record (CNAME) on the public DNS. CNAME 记录可将解析重定向到专用域名。The CNAME record redirects the resolution to the private domain name. 可以用专用终结点的专用 IP 地址替代解析。You can override the resolution with the private IP address of your private endpoints.

应用程序无需更改连接 URL。Your applications don't need to change the connection URL. 使用公共 DNS 服务进行解析时,DNS 服务器将解析为专用终结点。When resolving to a public DNS service, the DNS server will resolve to your private endpoints. 此过程不会影响现有应用程序。The process doesn't affect your existing applications.

重要

已将专用 DNS 区域用于给定类型的专用网络如果没有任何专用终结点连接,只能连接到公共资源,否则需要在专用 DNS 区域上进行相应的 DNS 配置才能完成 DNS 解析序列。Private networks already using the private DNS zone for a given type, can only connect to public resources if they don't have any private endpoint connections, otherwise a corresponding DNS configuration is required on the private DNS zone in order to complete the DNS resolution sequence.

对于 Azure 服务,请根据下表中所述使用建议的区域名称:For Azure services, use the recommended zone names as described in the following table:

中国China

专用链接资源类型/子资源Private link resource type / Subresource 专用 DNS 区域名称Private DNS zone name 公共 DNS 区域转发器Public DNS zone forwarders
Azure SQL 数据库 (Microsoft.Sql/servers)/SQL ServerAzure SQL Database (Microsoft.Sql/servers) / SQL Server privatelink.database.chinacloudapi.cnprivatelink.database.chinacloudapi.cn database.chinacloudapi.cndatabase.chinacloudapi.cn
Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)/SQLAzure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / SQL privatelink.documents.azure.cnprivatelink.documents.azure.cn documents.azure.cndocuments.azure.cn
Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)/MongoDBAzure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / MongoDB privatelink.mongo.cosmos.azure.cnprivatelink.mongo.cosmos.azure.cn mongo.cosmos.azure.cnmongo.cosmos.azure.cn
Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)/CassandraAzure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / Cassandra privatelink.cassandra.cosmos.azure.cnprivatelink.cassandra.cosmos.azure.cn cassandra.cosmos.azure.cncassandra.cosmos.azure.cn
Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)/GremlinAzure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / Gremlin privatelink.gremlin.cosmos.azure.cnprivatelink.gremlin.cosmos.azure.cn gremlin.cosmos.azure.cngremlin.cosmos.azure.cn
Azure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts)/TableAzure Cosmos DB (Microsoft.AzureCosmosDB/databaseAccounts) / Table privatelink.table.cosmos.azure.cnprivatelink.table.cosmos.azure.cn table.cosmos.azure.cntable.cosmos.azure.cn
Azure Database for PostgreSQL - 单一服务器 (Microsoft.DBforPostgreSQL/servers)/postgresqlServerAzure Database for PostgreSQL - Single server (Microsoft.DBforPostgreSQL/servers) / postgresqlServer privatelink.postgres.database.chinacloudapi.cnprivatelink.postgres.database.chinacloudapi.cn postgres.database.chinacloudapi.cnpostgres.database.chinacloudapi.cn
Azure Database for MySQL (Microsoft.DBforMySQL/servers)/mysqlServerAzure Database for MySQL (Microsoft.DBforMySQL/servers) / mysqlServer privatelink.mysql.database.chinacloudapi.cnprivatelink.mysql.database.chinacloudapi.cn mysql.database.chinacloudapi.cnmysql.database.chinacloudapi.cn
Azure Database for MariaDB (Microsoft.DBforMariaDB/servers)/mariadbServerAzure Database for MariaDB (Microsoft.DBforMariaDB/servers) / mariadbServer privatelink.mariadb.database.chinacloudapi.cnprivatelink.mariadb.database.chinacloudapi.cn mariadb.database.chinacloudapi.cnmariadb.database.chinacloudapi.cn

DNS 配置方案DNS configuration scenarios

服务的 FQDN 自动解析为公共 IP 地址。The FQDN of the services resolves automatically to a public IP address. 若要解析为专用终结点的专用 IP 地址,请更改 DNS 配置。To resolve to the private IP address of the private endpoint, change your DNS configuration.

DNS 是通过成功解析专用终结点 IP 地址使应用程序正常工作的一个关键组件。DNS is a critical component to make the application work correctly by successfully resolving the private endpoint IP address.

根据你的偏好,以下方案适用于集成的 DNS 解析:Based on your preferences, the following scenarios are available with DNS resolution integrated:

不带自定义 DNS 服务器的虚拟网络工作负荷Virtual network workloads without custom DNS server

此配置适用于不带自定义 DNS 服务器的虚拟网络工作负载。This configuration is appropriate for virtual network workloads without a custom DNS server. 在此方案中,客户端会向 Azure 提供的 DNS 服务 168.63.129.16 查询专用终结点 IP 地址。In this scenario, the client queries for the private endpoint IP address to the Azure-provided DNS service 168.63.129.16. Azure DNS 将负责专用 DNS 区域的 DNS 解析。Azure DNS will be responsible for DNS resolution of the private DNS zones.

备注

此方案使用 Azure SQL 数据库建议的专用 DNS 区域。This scenario uses the Azure SQL Database-recommended private DNS zone. 对于其他服务,可以使用以下参考来调整模型:Azure 服务 DNS 区域配置For other services, you can adjust the model using the following reference: Azure services DNS zone configuration.

若要正确进行配置,需要以下资源:To configure properly, you need the following resources:

以下屏幕截图显示了使用专用 DNS 区域的虚拟网络工作负载中的 DNS 解析序列:The following screenshot illustrates the DNS resolution sequence from virtual network workloads using the private DNS zone:

单个虚拟网络和 Azure 提供的 DNS

可将此模型扩展到与同一专用终结点关联的对等互连虚拟网络。You can extend this model to peered virtual networks associated to the same private endpoint. 向所有对等虚拟网络的专用 DNS 区域添加新的虚拟网络链接Add new virtual network links to the private DNS zone for all peered virtual networks.

重要

此配置需要使用单个专用 DNS 区域。A single private DNS zone is required for this configuration. 为不同的虚拟网络创建具有相同名称的多个区域时,需要通过手动操作来合并 DNS 记录。Creating multiple zones with the same name for different virtual networks would need manual operations to merge the DNS records.

重要

如果使用的是不同订阅的中心辐射型模型中的专用终结点,请在中心重用同一专用 DNS 区域。If you're using a private endpoint in a hub-and-spoke model from a different subscription, reuse the same private DNS zone on the hub.

在此方案中,有一个中心辐射型网络拓扑。In this scenario, there's a hub and spoke networking topology. 辐射型网络共用一个专用终结点。The spoke networks share a private endpoint. 辐射型虚拟网络关联到同一专用 DNS 区域。The spoke virtual networks are linked to the same private DNS zone.

具有 Azure 提供的 DNS 的中心辐射型拓扑

使用 DNS 转发器的本地工作负荷On-premises workloads using a DNS forwarder

要使本地工作负载解析专用终结点的 FQDN,可使用 DNS 转发器在 Azure 中解析 Azure 服务公共 DNS 区域For on-premises workloads to resolve the FQDN of a private endpoint, use a DNS forwarder to resolve the Azure service public DNS zone in Azure.

以下方案适用于在 Azure 中具有 DNS 转发器的本地网络。The following scenario is for an on-premises network that has a DNS forwarder in Azure. 此转发器通过服务器级转发器将所有 DNS 查询解析为 Azure 提供的 DNS 168.63.129.16This forwarder resolves DNS queries via a server-level forwarder to the Azure provided DNS 168.63.129.16.

备注

此方案使用 Azure SQL 数据库建议的专用 DNS 区域。This scenario uses the Azure SQL Database-recommended private DNS zone. 对于其他服务,可以使用以下参考来调整模型:Azure 服务 DNS 区域配置For other services, you can adjust the model using the following reference: Azure services DNS zone configuration.

若要正确进行配置,需要以下资源:To configure properly, you need the following resources:

下图显示了本地网络中的 DNS 解析顺序。The following diagram illustrates the DNS resolution sequence from an on-premises network. 配置使用 Azure 中部署的 DNS 转发器。The configuration uses a DNS forwarder deployed in Azure. 该解析是通过关联到虚拟网络的专用 DNS 区域进行的:The resolution is made by a private DNS zone linked to a virtual network:

使用 Azure DNS 的本地网络

可以为已有 DNS 解决方案的本地网络扩展此配置。This configuration can be extended for an on-premises network that already has a DNS solution in place. 将本地 DNS 解决方案配置为通过条件转发器将 DNS 流量转发到 Azure DNS。The on-premises DNS solution is configured to forward DNS traffic to Azure DNS via a conditional forwarder. 该条件转发器引用部署在 Azure 中的 DNS 转发器。The conditional forwarder references the DNS forwarder deployed in Azure.

备注

此方案使用 Azure SQL 数据库建议的专用 DNS 区域。This scenario uses the Azure SQL Database-recommended private DNS zone. 对于其他服务,可以使用以下参考来调整模型:Azure 服务 DNS 区域配置For other services, you can adjust the model using the following reference: Azure services DNS zone configuration

若要正确进行配置,需要以下资源:To configure properly, you need the following resources:

下图显示了本地网络中的 DNS 解析。The following diagram illustrates the DNS resolution from an on-premises network. DNS 解析按条件转发到 Azure。DNS resolution is conditionally forwarded to Azure. 该解析是通过关联到虚拟网络的专用 DNS 区域进行的。The resolution is made by a private DNS zone linked to a virtual network.

重要

条件转发必须指向建议的公共 DNS 区域转发器The conditional forwarding must be made to the recommended public DNS zone forwarder. 例如,database.chinacloudapi.cn 而不是 privatelink.database.chinacloudapi.cn。For example: database.chinacloudapi.cn instead of privatelink.database.chinacloudapi.cn.

本地转发到 Azure DNS

使用 DNS 转发器的虚拟网络和本地工作负载Virtual network and on-premises workloads using a DNS forwarder

要使工作负载从虚拟网络和本地网络访问专用终结点,请使用 DNS 转发器来解析部署在 Azure 中的 Azure 服务公共 DNS 区域For workloads accessing a private endpoint from virtual and on-premises networks, use a DNS forwarder to resolve the Azure service public DNS zone deployed in Azure.

以下方案适用于在 Azure 中具有虚拟网络的本地网络。The following scenario is for an on-premises network with virtual networks in Azure. 这两种网络都可访问位于共享中心网络的专用终结点。Both networks access the private endpoint located in a shared hub network.

此 DNS 转发器负责通过服务器级转发器将所有 DNS 查询解析为 Azure 提供的 DNS 服务 168.63.129.16This DNS forwarder is responsible for resolving all the DNS queries via a server-level forwarder to the Azure-provided DNS service 168.63.129.16.

重要

此配置需要使用单个专用 DNS 区域。A single private DNS zone is required for this configuration. 所有从本地和对等虚拟网络建立的客户端连接也必须使用同一专用 DNS 区域。All client connections made from on-premises and peered virtual networks must also use the same private DNS zone.

备注

此方案使用 Azure SQL 数据库建议的专用 DNS 区域。This scenario uses the Azure SQL Database-recommended private DNS zone. 对于其他服务,可以使用以下参考来调整模型:Azure 服务 DNS 区域配置For other services, you can adjust the model using the following reference: Azure services DNS zone configuration.

若要正确进行配置,需要以下资源:To configure properly, you need the following resources:

下图显示了两种网络(本地网络和虚拟网络)的 DNS 解析。The following diagram shows the DNS resolution for both networks, on-premises and virtual networks. 该解析使用 DNS 转发器。The resolution is using a DNS forwarder. 该解析是通过关联到虚拟网络的专用 DNS 区域进行的:The resolution is made by a private DNS zone linked to a virtual network:

混合方案

后续步骤Next steps