In our Azure landscape we have a couple of VMs. For one of those we have the requirement that it needs to have a DNS name to be able to access it. We had some trouble with private DNS zones in the past so instead we opted to bind a public IP to the machine which would give us a free (.cloudapp.azure.com) DNS.

This VM should not be available from the internet, so we added a NSG on the subnet it lives in which blocks outside traffic but allows virtual network traffic.

On a different, paired, vnet we have a VPN gateway which I can use to access the environment and its internal resources. Now what I'm seeing is that I cannot use the DNS name of this machine to connect to it, unless I open up that previously mentioned NSG to allow all traffic. At first I thought: makes sense, the traffic is routed to the public IP to its seen as "outside" traffic even though I've got the VPN up and running. So I added a local route (route add ...) directing the traffic to the public IP to my VPN gateway address. My reasoning: traffic is now directed over the VPN so from there on Azures internal routing will ensure that the traffic is seen as virtual network traffic and all will be well.

Sufficient to say: this does not work. But I can't seem to figure out why it doesn't, and that's what I would like to know. If there's any other ways to fulfill the requirements that would be OK as well (minus the private DNS option, which doesn't work for VPN either I believe).


I believe you will need either your own DNS or at least your own DNS proxy server.

This article provides a great break down of different Azure name resolution scenarios and the supported solution:

Name resolution for resources in Azure virtual networks

Specifically "Resolution of Azure hostnames from on-premises computers.", the stated approach is "Forward queries to a customer-managed DNS proxy server in the corresponding virtual network, the proxy server forwards queries to Azure for resolution".

  • Thanks for that link, very useful. I'm not 100% convinced yet that a custom DNS is really required. It's also a matter of routing. We're seeing that traffic is blocked because it's originating address is our external internet facing IP, not the IP we're assigned from the VPN gateway. I understood that forced tunneling might be able to fix that, but we still need to investigate further.
    – Jasper
    Jul 18 '19 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.