Azure Firewall DNS Proxy & DNS Private Resolver

Joni Nieminen 20

I am trying to achieve a setup where I have the following main components.

Hub vnet 10.0.0.0/23
- This has a VPN connection to on-premises
- This has a Azure Firewall
Shared services vnet 10.0.3.0/24
- This has DNS Private Resolver
  - With inbound and outbound subnets 10.0.3.0/28 and 10.0.3.16/28
Spoke vnet 10.0.4.0/24
- This has a client trying to resolve on-premises company.local DNS records
- Spoke vnet is peered to the hub vnet
- Spoke vnet has UDR 0.0.0.0/0 towards the Azure Firewall in hub

I have enabled DNS Proxy in the Azure firewall. I have also enabled custom DNS server for Azure Firewall and it uses the private resolver inbound IP address as it's DNS (10.0.3.4).

Secondly the spoke vnet is set to use the Azure Firewall as it's DNS, since the DNS Proxy is enabled. Spoke vnet has DNS 10.0.0.4 (Azure Firewall).

I have a DNS forwarding ruleset linked to the shared services vnet which hosts the private resolver. It has a rule to forward company.local. lookups towards the on-premises DNS/DC servers via the VPN connection.

The conditional forwarding to on-premises is unable to resolve the company.local records. It's getting timed out and the DNS proxy logs in Azure Firewall says:

Error: 0 srv01.company.local. A: read udp 10.0.0.7:25816->10.0.3.4:53: i/o timeout

So here 10.0.0.7 is the Azure Firewall and 10.0.3.4 is the Private Resolver inbound IP address which the firewall uses as it's DNS.

If I remove the Firewall DNS proxy from the picture, the name resolution works fine. Is anyone aware whether this setup is even supported, or got any clues what's wrong in my setup? I have a feeling this could have something to do with DNS looping and/or UDR/static routing.

Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-22T17:57:41.0766667+00:00
Hi Joni Nieminen

Greetings,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

When the Azure Firewall's DNS Proxy is enabled, it may be causing a loop where DNS queries are sent back and forth between the Firewall and the Private Resolver without reaching the on-premises DNS servers.

The error message indicates that the Azure Firewall is trying to resolve the DNS query but is timing out, likely because it is not able to reach the on-premises DNS server.

Ensure that the UDRs are correctly configured to allow traffic from the Azure Firewall to the on-premises DNS servers. The UDR should not inadvertently route traffic back to the Private Resolver

As you mentioned, removing the DNS Proxy allows resolution to work. This indicates that the issue lies within the DNS Proxy configuration. Temporarily disable it to confirm that the forwarding ruleset is functioning correctly.

NOTE: A DNS server maintains and resolves domain names to IP addresses. By default, Azure Firewall uses Azure DNS for name resolution. The DNS server setting lets you configure your own DNS servers for Azure Firewall name resolution. You can configure a single server or multiple servers. If you configure multiple DNS servers, the server used is chosen randomly. You can configure a maximum of 15 DNS servers in Custom DNS.

In forwarding we need to give own DNS, not inbound IP address.

Refer: https://learn.microsoft.com/en-us/azure/firewall/dns-details?source=recommendations

If you have any further queries, do let us know.

Hope this clarifies.

Thanks,

Ganesh
Joni Nieminen 20 Reputation points

2024-10-23T05:34:06.3533333+00:00
Hey Ganesh and thank you for the explanation.

I believe my issue lies in the UDR configuration and here's how it's currently setup although name resolution doesn't work.

Spoke subnet UDR:

0.0.0.0/0 -> Azure Firewall

172.16.0.0/12 (onprem) -> Azure Firewall

This is to override the Virtual Network Gateway propagated system route so the spoke won't bypass Azure Firewall while traversing to onprem

10.0.3.0/24 -> Azure Firewall

This is the traffic to the shared virtual network hosting the Private Resolver, although it should be unnecessary as it's covered in the 0.0.0.0/0 route already

gatewaySubnet UDR:

10.0.3.0/24 -> Azure Firewall

Allowing the return traffic to Azure Firewall to avoid asynchronous routing for Private Resolver

10.0.4.0/24 -> Azure Firewall

Allowing the return traffic to Azure Firewall to avoid asynchronous routing for spoke vnet

PrivateResolverInboundSubnet UDR:

0.0.0.0/0 -> Azure Firewall

172.16.0.0/12 (onprem) -> Azure Firewall

This is to override the Virtual Network Gateway propagated system route so the private resolver inbound subnet won't bypass Azure Firewall while traversing to onprem

PrivateResolverOutboundSubnet UDR:

0.0.0.0/0 -> Azure Firewall

172.16.0.0/12 (onprem) -> Azure Firewall

This is to override the Virtual Network Gateway propagated system route so the private resolver outbound subnet won't bypass Azure Firewall while traversing to onprem

DNS Settings:

Hub virtual network

Default (Azure-provided)

Shared services virtual network (Private Resolver)

Default (Azure-provided)

Spoke virtual network

Azure Firewall (10.0.0.4)

DNS Forwarding Ruleset:

Rule contains company.local. -> onpremises DNS servers on port 53

Rule is linked to the hub virtual network

The same forwarding ruleset works fine when the DNS proxy/firewall/UDR's are taken out of the picture.
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-23T16:04:19.18+00:00
Hello Joni Nieminen,

Add Route for DNS settings 0.0.0.0/0 and Next Hop as Internet and Test.

Meanwhile whitelist the below

53 UDP/TCP inbound for inbound endpoints.

53 UDP/TCP outbound and inbound for outbound endpoints.

Hope this clarifies

Thanks

Ganesh

If you need further assistance with any of these workarounds or have specific questions about implementation, feel free to ask!
Joni Nieminen 20 Reputation points

2024-10-24T13:14:41.26+00:00
I found the root cause to be missing gateway route propagation on the VPN gateway, this was set to No/Disabled in the Bicep code which deploys the GatewaySubnet Route Table.
Once I set the disableBgpRoutePropagation to false the connection started working as expected including the name resolution.

resource RouteTableResource 'Microsoft.Network/routeTables@2020-03-01' = [for i in range(0, length(RouteTables)): { name: RouteTables[i].name location: resourceGroup().location properties: { disableBgpRoutePropagation: true routes: RouteTables[i].routes } }]
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-24T14:23:14.54+00:00

Hey Joni Nieminen,

I believe you have correctly resolved the issue, but please let me know if you require any additional support. Kindly let me know.

Regards,Ganesh

Accepted answer

Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-25T15:35:22.17+00:00

Hey Joni Nieminen

Greetings,

Thank you for reaching out to us on the Microsoft Q&A forum.

As an original poster cannot accept their own answer, I am reposting it so that you can accept it an answer. Accepted answer will help other community members navigate to the appropriate solutions.

Issue: Setup for Azure Firewall DNS Proxy & DNS Private Resolver

Solution: I found the root cause to be missing gateway route propagation on the VPN gateway, this was set to No/Disabled in the Bicep code which deploys the GatewaySubnet Route Table. Once I set the disableBgpRoutePropagation to false the connection started working as expected including the name resolution.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information helps you, as this can be beneficial to other community members.

Your contribution is greatly appreciated.

Regards,

Ganesh
Please sign in to rate this answer.

1 person found this answer helpful.
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-28T08:51:14.4033333+00:00

Hello Joni Nieminen

We appreciate your patience!

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information helps you, as this can be beneficial to other community members.

Your contribution is greatly appreciated.

Regards,

Ganesh
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Firewall DNS Proxy & DNS Private Resolver

0 additional answers

Your answer