Azure VPN client not able to resolve private DNC

Hello Amandeep Sadioura ,

Welcome to Q&A, You’ve set up a VPN connection to access your private AKS cluster. While you can ping the private nodes just fine, resolving the API endpoint of the cluster isn’t working as expected. Sounds like there’s a DNS resolution issue somewhere along the way.

I’m assuming you’ve already got the essentials covered: the VPN connection is established, and the setup for your AKS cluster and the private DNS zone has been done. Also, the VPN client itself is correctly configured and functional enough to connect to the network.

Here some suggestions to find a solution for your issue:

• First, make sure the virtual network (VNet) where your AKS cluster lives is using the correct DNS server settings. The DNS server should point to the private DNS zone associated with the cluster. If the DNS server isn’t configured properly, it won’t know how to resolve private endpoints.
• Next, check the association between your private DNS zone and the VNet hosting the cluster. If the DNS zone isn’t linked to the VNet, it’ll cause DNS resolution to fail even though network connectivity is intact.
• If your VPN configuration allows you to specify DNS servers, double-check that the DNS server for your private DNS zone is included in the configuration. Adding the appropriate DNS suffix for your private AKS cluster could also help resolve endpoints smoothly.
• To test whether DNS resolution is working independently of the VPN, use a tool like nslookup or equivalent to query your API endpoint while specifying the DNS server’s IP address. If this works, then the issue may be with how DNS queries are handled by the VPN setup. One way to test things out is by using the nslookup command in your terminal. For example:

nslookup <your-private-aks-endpoint> <dns-server-ip>

Finally, ensure there are no firewall rules blocking DNS traffic between your VPN client and the private DNS zone. Firewalls can sometimes restrict traffic even when everything else seems to be properly configured.

References:

• https://learn.microsoft.com/en-us/answers/questions/2149977/configuring-dns-with-azure-vpn-client-and-private
• https://learn.microsoft.com/en-us/answers/questions/39571/not-resolving-private-dns-zone-over-point-to-site

If the information helped address your question, please Accept the answer.

Luis

Hi Luis,

Thanks for getting back to me

I am on Mac and using Azure VPN client which has split tunneling by default

• My AKS cluster and VPN are in same VNET with different subnets and the VNET currently using Default (Azure-provided) as DNS
• Private endpoint is linked for VNET to MC_AKS_RG
• I am using XML that VPN gave me for P2S
• I tried already
  nslookup aks-dev-xxxxxxx.privatelink.canadacentral.azmk8s.io 168.63.129.16

connection timed out; no servers could be reached

Thanks and please let me know what else I can try

Amandeep

Hi Amandeep Sadioura,

To add DNS suffixes, modify the downloaded profile XML file and add the <dnssuffixes> private DNS zone name and then import.

https://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-optional-configurations

Private DNS Zones in Azure do not automatically propagate DNS settings to P2S VPN clients, you need to configure your own DNS proxy/forwarder.

https://github.com/groovy-sky/azure/tree/master/paas-vnet-02#integrate-platform-as-a-services-with-virtual-networks-part-3

Please find the workaround followed here for more detailed information: https://learn.microsoft.com/en-us/answers/questions/39571/not-resolving-private-dns-zone-over-point-to-site

If the information is helpful, please click on "Upvote"

If you have any queries, please do let us know, we will help you.

Hi Markapuram

I tried with below but result is still same

<clientconfig>

<dnssuffixes>

<dnssuffix>privatelink.canadacentral.azmk8s.io</dnssuffix>

</dnssuffixes>

</clientconfig>

Added that block in XML and re-import in Azure VPN Client on my Mac
Then reconnected

nslookup aks-dev-xxxxxxx.privatelink.canadacentral.azmk8s.io

Server: 8.8.8.8

Address: 8.8.8.8#53

Seems like it's still taking DNS as 8.8.8.8 and not resolving even with dnssuffix

Let me know what can I do next

Sincerely,
Amandeep

Hello Amandeep Sadioura,

It looks like the core issue is that Azure DNS (168.63.129.16) isn’t reachable from P2S VPN clients, which is expected behavior. Adding a <dnssuffix> alone won't help if the DNS server being used is still 8.8.8.8.

You can try to resolve this by following the below steps once-

1. Deploy a DNS forwarder VM (e.g. Ubuntu with BIND) inside the same VNet.
2. Configure it to forward all queries to 168.63.129.16.
3. Update your VNet DNS settings and the Azure VPN profile XML to point to this custom DNS server.

Once done, reconnect your VPN and nslookup for the AKS private endpoint should succeed.