Inbound endpoint

Overview

An Inbound Endpoint provides a service IP address that acts as a nameserver for DNS resolution within Alibaba Cloud. You can configure this address as the DNS server for clients inside your cloud network, such as ECS instances or containers. You can also configure it as the target IP address for clients outside your cloud network, such as hosts in an on-premises data center or external DNS servers, to access the internal DNS resolution service. Inbound Endpoints are available in two types: system-assigned and custom. The default system-assigned internal DNS resolution service addresses are 100.100.2.136 and 100.100.2.138. These addresses use anycast to provide DNS resolution for all VPCs in all regions. This service is free of charge.

Available regions

This feature is available in the following regions:

• Public cloud regions: South Korea (Seoul), Singapore, China (Hong Kong), China (Shanghai), China (Beijing), China (Hangzhou), China (Ulanqab), China (Shenzhen), Philippines (Manila), US (Virginia), Malaysia (Kuala Lumpur), Germany (Frankfurt), Indonesia (Jakarta), and Japan (Tokyo).

• Finance Cloud regions: China (Hangzhou), China (Beijing), and China (Shanghai).

Limitations

Usage rules

The usage rules for an Inbound Endpoint vary based on the source of DNS query traffic.

DNS queries from internal clients

DNS queries from external clients

Add Inbound Endpoint

1. Go to the Alibaba Cloud DNS - Private DNS console.

2. On the Inbound Endpoint tab, click Add Inbound Endpoint and configure the parameters.

   Parameter	Description
   Edition	The edition of the Inbound Endpoint. Only Standard Edition is available.
   Endpoint Name	Enter a name for the endpoint based on your business requirements.
   Inbound VPC	All inbound DNS queries are routed through this VPC. Important To prevent service interruptions, you cannot change the associated inbound VPC after the Inbound Endpoint is created. For a list of supported regions, see the "Available regions" section. To request this feature in another region, submit a ticket and specify the region.
   Security Group	The rules of the security group are applied to the inbound VPC. For more information about how to create a security group, see Create a security group. Important In the inbound rules of the security group for the inbound VPC, you must allow traffic on port 53 from the source CIDR blocks of DNS queries. If the inbound traffic originates from other VPCs in Alibaba Cloud, you must allow outbound traffic on port 53 in the security groups of those VPCs.
   Inbound service IP addresses	Specify at least two available IP addresses from the vSwitches in an availability zone. These IP addresses must not be in use by ECS instances. For high availability, we recommend distributing these IP addresses across different availability zones. An Inbound Endpoint supports a maximum of six inbound service IP addresses. Important You cannot add or modify an Inbound Endpoint service IP address if it is the same as the destination IP address of a forwarding rule and the outbound endpoint of that rule is in the same VPC as the Inbound Endpoint. This restriction does not apply if the endpoints are in different VPCs. If a resolution loop occurs because the VPCs are connected through CEN, a SERVFAIL error is returned. If you do not specify IP addresses, the system automatically assigns them.

3. Submit the form to create the Inbound Endpoint.

4. The newly created endpoint and existing endpoints appear in the Inbound Endpoint list. The status of an Inbound Endpoint can be Normal, Creating, Create failed., Modifying, Modify failed., or Abnormal.

   Important

   • Creating an Inbound Endpoint takes about 5 to 10 minutes. If the status is Creating, wait for the process to complete.

   • You cannot modify or delete an endpoint that is in the Creating or Modifying state. If the status is Abnormal or Modify failed., you can submit a ticket for assistance.

Modify an inbound endpointInbound Endpoint

1. Go to the Alibaba Cloud DNS - Private DNS console.

2. On the Inbound Endpoint tab, find the target endpoint and click Edit in the Actions column.

3. In the Modify Inbound Endpoint dialog box, you can modify settings such as the Endpoint Name, Inbound service IP addresses, and Edition. The Inbound VPC and Security Group cannot be changed after the endpoint is created. You must add a minimum of two and a maximum of six inbound service IP addresses. For each IP address, you must select an availability zone, a vSwitch, and an IP address. Before you modify or delete an IP address, ensure that its DNS query traffic is redirected to other active IP addresses.

4. After you submit the form, the status of the endpoint changes to Modifying. You cannot perform other operations on the endpoint while it is in this state.

Delete an inbound endpointInbound Endpoint