Private Endpoints, Private DNS & Hybrid DNS
Microsoft Azure Networking (AZ-700 track) Azure portal — free tier (GUI + CLI)
مقصدObjectiveObjective
VNet سے linked Private DNS zone بنانا اور سمجھنا کہ Private Endpoints PaaS traffic کو کیسے secure کرتے ہیں۔VNet se linked Private DNS zone banana aur samajhna ke Private Endpoints PaaS traffic ko kaise secure karte hain.Create a Private DNS zone linked to a VNet and understand how Private Endpoints secure PaaS traffic.
آسان مثالSimple AnalogySimple Analogy
Private Endpoint سوسائٹی کے warehouse کا private side door ہے — supplier کبھی عوامی سڑک پر نہیں چلتا۔ Private DNS zone internal name board ہے جو side door کے نام کو اس کے private address سے map کرتا ہے۔Private Endpoint society ke warehouse ka private side door hai — supplier kabhi public road par nahi chalta. Private DNS zone internal name board hai jo side door ke naam ko us ke private address se map karta hai.A Private Endpoint is like a private side door into the society's warehouse — the supplier never walks on the public road. The Private DNS zone is the internal name board that maps the side door's name to its private address.
سیٹ اپLab SetupLab Setup
rg-netsec-lab اور vnet-core استعمال کریں۔ آپ blob storage FQDN pattern کے لیے Private DNS zone بنا کر اسے VNet سے link کریں گے۔rg-netsec-lab aur vnet-core use karein. Aap blob storage FQDN pattern ke liye Private DNS zone bana kar use VNet se link karein ge.Use rg-netsec-lab and vnet-core. You will create a Private DNS zone for the blob storage FQDN pattern and link it to the VNet.
اقداماتStepsSteps
Step 1
privatelink.blob.core.windows.net نام کی Private DNS zone بنائیں۔ نام privatelink.<service> pattern پر ہے جو Azure PaaS services استعمال کرتی ہیں۔privatelink.blob.core.windows.net naam ki Private DNS zone banayein. Naam privatelink.<service> pattern par hai jo Azure PaaS services use karti hain.Create a Private DNS zone named privatelink.blob.core.windows.net. The name follows the privatelink.<service> pattern that Azure PaaS services use.
az network private-dns zone create --resource-group rg-netsec-lab --name privatelink.blob.core.windows.net
🖱️ Private DNS zones > Create — نام privatelink.blob.core.windows.netPrivate DNS zones > Create — naam privatelink.blob.core.windows.netPrivate DNS zones > Create — name privatelink.blob.core.windows.net
Step 2
Private DNS zone کو vnet-core سے link کریں auto-registration enabled کے ساتھ۔ VNet کے اندر VMs اب private FQDNs اس zone سے resolve کریں گی۔Private DNS zone ko vnet-core se link karein auto-registration enabled ke saath. VNet ke andar VMs ab private FQDNs is zone se resolve karengi.Link the Private DNS zone to vnet-core with auto-registration enabled. VMs in the VNet will now resolve private FQDNs through this zone.
az network private-dns link vnet create --resource-group rg-netsec-lab --zone-name privatelink.blob.core.windows.net --name link-vnet-core --virtual-network vnet-core --registration-enabled true
🖱️ Private DNS zones > privatelink.blob.core.windows.net > Virtual network links > Add — vnet-core link کریں، auto-registration enable کریںPrivate DNS zones > privatelink.blob.core.windows.net > Virtual network links > Add — vnet-core link karein, auto-registration enable kareinPrivate DNS zones > privatelink.blob.core.windows.net > Virtual network links > Add — link vnet-core, enable auto-registration
Step 3
Storage accounts > Create کھولیں اور networking options دیکھیں: public access بمقابلہ private endpoints۔ Private Endpoint آپ کے VNet کے اندر private IP لیتا ہے — ٹریفک کبھی انٹرنیٹ کو touch نہیں کرتی۔Storage accounts > Create kholein aur networking options dekhein: public access vs private endpoints. Private Endpoint aap ke VNet ke andar private IP leta hai — traffic kabhi internet ko touch nahi karti.Open Storage accounts > Create and look at networking options: public access vs private endpoints. A Private Endpoint gets a private IP inside your VNet — traffic never touches the internet.
🖱️ Storage accounts > Create — Public network access setting نوٹ کریں، پھر Private endpointsStorage accounts > Create — Public network access setting note karein, phir Private endpointsStorage accounts > Create — note the Public network access setting, then Private endpoints
Step 4
Resolution flow سمجھیں: VM storage FQDN query کرتا ہے، Private DNS zone Private Endpoint کے private IP سے جواب دیتی ہے، اور ٹریفک VNet کے اندر رہتی ہے۔Resolution flow samjhein: VM storage FQDN query karta hai, Private DNS zone Private Endpoint ke private IP se jawab deti hai, aur traffic VNet ke andar rehti hai.Understand the resolution flow: a VM queries the storage FQDN, the Private DNS zone answers with the private IP of the Private Endpoint, and traffic stays inside the VNet.
🖱️ Private DNS zones > privatelink.blob.core.windows.net > Overview — DNS resolution flow نوٹ کریںPrivate DNS zones > privatelink.blob.core.windows.net > Overview — DNS resolution flow note kareinPrivate DNS zones > privatelink.blob.core.windows.net > Overview — note DNS resolution flow
Step 5
Zone کے record sets کی فہرست بنائیں۔ Auto-registration on ہونے پر ہر نیا private endpoint یہاں اپنا A record خود شامل کرتا۔Zone ke record sets list karein. Auto-registration on hone par har naya private endpoint yahan apna A record khud add karta.List the record sets in the zone. With auto-registration on, each new private endpoint would add its A record here automatically.
az network private-dns record-set list --resource-group rg-netsec-lab --zone-name privatelink.blob.core.windows.net --output table
🖱️ Private DNS zones > privatelink.blob.core.windows.net > DNS Management > RecordsPrivate DNS zones > privatelink.blob.core.windows.net > DNS Management > RecordsPrivate DNS zones > privatelink.blob.core.windows.net > DNS Management > Records
Step 6
DNS Private Resolver concepts کا جائزہ لیں: inbound endpoint on-premises DNS کو Azure Private DNS میں queries forward کرنے دیتا ہے۔ صرف concepts — deploy نہ کریں۔DNS Private Resolver concepts review karein: inbound endpoint on-premises DNS ko Azure Private DNS mein queries forward karne deta hai. Sirf concepts — deploy na karein.Review DNS Private Resolver concepts: an inbound endpoint lets on-premises DNS forward queries into Azure Private DNS. Concepts only — do not deploy.
🖱️ DNS private resolvers > Create — inbound/outbound endpoint concepts کا جائزہ لیںDNS private resolvers > Create — inbound/outbound endpoint concepts review kareinDNS private resolvers > Create — review inbound/outbound endpoint concepts
تصدیقVerifyVerify
Private DNS zone privatelink.blob.core.windows.net موجود ہے اور auto-registration enabled کے ساتھ vnet-core سے linked ہے۔Private DNS zone privatelink.blob.core.windows.net maujood hai aur auto-registration enabled ke saath vnet-core se linked hai.The Private DNS zone privatelink.blob.core.windows.net exists and is linked to vnet-core with auto-registration enabled.
az network private-dns link vnet list --resource-group rg-netsec-lab --zone-name privatelink.blob.core.windows.net --output table
خرابی دور کرناTroubleshootingTroubleshooting
⚠️ Private FQDN public IP سے resolve ہو رہا ہے private IP کی بجائےPrivate FQDN public IP se resolve ho raha hai private IP ki bajayePrivate FQDN resolves to a public IP instead of the private IP
✅ Private DNS zone کا VNet link missing ہے یا auto-registration off ہے۔ Virtual network links چیک کریں اور تصدیق کریں کہ zone کا نام privatelink.<service> سے match کرتا ہے۔Private DNS zone ka VNet link missing hai ya auto-registration off hai. Virtual network links check karein aur tasdeeq karein ke zone ka naam privatelink.<service> se match karta hai.The VNet link to the Private DNS zone is missing or auto-registration is off. Check Virtual network links and confirm the zone name matches privatelink.<service>.
⚠️ On-premises machines private names resolve نہیں کر سکتیںOn-premises machines private names resolve nahi kar saktiOn-premises machines cannot resolve private names
✅ On-premises DNS server پر privatelink zone کے لیے conditional forwarder لگائیں، Azure DNS (168.63.129.16) یا DNS Private Resolver inbound endpoint کی طرف۔On-premises DNS server par privatelink zone ke liye conditional forwarder lagayein, Azure DNS (168.63.129.16) ya DNS Private Resolver inbound endpoint ki taraf.Add a conditional forwarder on the on-premises DNS server for the privatelink zone, pointing to Azure DNS (168.63.129.16) or to a DNS Private Resolver inbound endpoint.
انٹرویو سوالاتInterview Q&AInterview Q&A
❓ Private Endpoint کیا ہے اور Private DNS کا اس میں کیا کردار ہے؟Private Endpoint kya hai aur Private DNS ka is mein kya kirdar hai?What is a Private Endpoint and what role does Private DNS play?
Private Endpoint آپ کے VNet کے اندر ایک network interface ہے جو Azure PaaS resource (جیسے storage account) کو private IP دیتا ہے، تاکہ ٹریفک عوامی انٹرنیٹ پر نہ جائے۔ Private DNS zone VNet کے اندر PaaS FQDN کو اس private IP سے resolve کرتا ہے۔Private Endpoint aap ke VNet ke andar ek network interface hai jo Azure PaaS resource (jaise storage account) ko private IP deta hai, taake traffic public internet par na jaye. Private DNS zone VNet ke andar PaaS FQDN ko us private IP se resolve karta hai.A Private Endpoint is a network interface inside your VNet that gives a private IP to an Azure PaaS resource (like a storage account), so traffic stays off the public internet. A Private DNS zone resolves the PaaS FQDN to that private IP inside the VNet.
❓ Hybrid on-premises setup میں Private DNS کیسے کام کرتی ہے؟Hybrid on-premises setup mein Private DNS kaise kaam karti hai?How do you make Private DNS work in a hybrid on-premises setup?
Private DNS zone link پر auto-registration on کریں تاکہ نئے private endpoints خود register ہو جائیں۔ Hybrid کے لیے on-premises پر DNS forwarder لگائیں جو Private DNS zone کی طرف point کرے، یا Azure DNS Private Resolver استعمال کریں۔Private DNS zone link par auto-registration on karein taake naye private endpoints khud register ho jayein. Hybrid ke liye on-premises par DNS forwarder lagayein jo Private DNS zone ki taraf point kare, ya Azure DNS Private Resolver use karein.Set auto-registration on the Private DNS zone link so new private endpoints register automatically. For hybrid, add a DNS forwarder on-premises pointing to the Private DNS zone, or use Azure DNS Private Resolver.