Background
The DNS service resolves domain names to IP addresses. For a technology company, setting up an internal DNS is essential. When a company migrates its services to Alibaba Cloud, it must connect its on-premises network to the cloud environment. DNS plays a key role in this internal addressing service. After migrating to the cloud, a common challenge for customers is using Alibaba Cloud DNS for internal domain name resolution from their on-premises network.
This topic provides a solution for using Alibaba Cloud DNS to resolve internal domain names in a VPN connection scenario.
Scenarios
The DNS server provided in an Alibaba Cloud Virtual Private Cloud (VPC) supports the PrivateZone feature. You can use a VPN Gateway to connect an on-premises network, such as a data center or branch office, to your VPC using the IPsec protocol. This tutorial shows how to access Alibaba Cloud PrivateZone through a VPN Gateway.
Prerequisites
The IP addresses of the Alibaba Cloud PrivateZone DNS servers are as follows:
No. |
PrivateZone server IP address |
1 |
100.100.2.136/32 |
2 |
100.100.2.138/32 |
Alibaba Cloud VPN Service (https://www.aliyun.com/product/vpn)
Configuration
Step 1: Configure an IPsec connection on the VPN Gateway to access the DNS server
Create a new IPsec connection on your existing VPN Gateway.
Click Edit and expand the Advanced Configuration section. Configure the parameters as follows:
Configuration item |
Configuration |
Name |
Custom |
VPN Gateway |
Automatically populated. |
Customer gateway |
Automatically populated. |
Local CIDR Block |
192.168.0.0/16 (replace with your CIDR block) |
Remote CIDR Block |
10.0.0.0/24 (Replace with your CIDR block) |
Effective Immediately |
Yes |
Pre-shared Key |
Custom |
Version |
ikev1 |
Negotiation Mode |
main |
Encryption Algorithm |
aes |
Authentication Algorithm |
sha1 |
DH Group |
group2 |
SA Lifetime (seconds) |
86400 |
LocalId |
39.96.2.138 (Replace with the public IP address of the VPN Gateway.) |
Remote ID |
39.96.0.248 (Replace with the public IP address of the customer gateway.) |
IPsec configuration
Configuration item |
Configuration |
Encryption Algorithm |
aes |
Authentication Algorithm |
sha1 |
DH Group |
group2 |
SA Lifetime (seconds) |
86400 |
Step 2: Create an IPSec connection from the on-premises network to the VPN Gateway
Click Create IPsec-VPN Connection to create another IPsec connection on the same VPN Gateway. Keep all parameters the same as the previous connection, except for the Local CIDR Block. Otherwise, the Phase 1 negotiation of IPsec may fail.
Configuration item |
Configuration |
Name |
Custom |
VPN Gateway |
Custom |
Customer gateway |
Custom |
Local CIDR Block |
100.100.2.128/25 (DNS service CIDR block) |
Remote CIDR Block |
192.168.0.0/16 (Replace with the CIDR block of your on-premises network.) |
Effective Immediately |
Yes |
Pre-shared Key |
Custom |
Version |
ikev1 |
Negotiation Mode |
main |
Encryption Algorithm |
aes |
Authentication Algorithm |
sha1 |
DH Group |
group2 |
SA Lifetime (seconds) |
86400 |
LocalId |
39.96.0.248 (replace) |
RemoteId |
39.96.2.128 (Replace with the public IP address of the customer gateway.) |
IPsec configuration
Configuration item |
Configuration |
Encryption Algorithm |
aes |
Authentication Algorithm |
sha1 |
DH Group |
group2 |
SA Lifetime (seconds) |
86400 |
Step 3: Configure the on-premises network
Configure the corresponding IPsec connections on your on-premises gateway device. You may need to contact your network engineer for assistance. Use the same parameters as specified above. For detailed instructions, see the documentation for your device.
Configure routing for the on-premises network. Point the route for 100.100.2.136/32 to the IPsec tunnel on the on-premises VPN gateway.
Step 4: Monitor the IPsec tunnel
If all configurations are correct, the IPsec tunnel negotiation should succeed. If you encounter any issues, contact Alibaba Cloud technical support or your company's network engineer.
Step 5: Verify domain name resolution
Use the ping command to verify connectivity to the DNS server. The latency depends on the quality of the public network connection between your data center and the VPN Gateway.
Use 100.100.2.136 to resolve a PrivateZone domain name.
After the verification is successful, your on-premises network and Alibaba Cloud VPC can share DNS resolution through the VPN Gateway.