Azure Hub-Spoke架构下DNS地址解析失败技术求助

我采用Hub-Spoke网络架构，已配置Azure DNS区域，Hub中部署了Azure防火墙，Spoke子网关联了路由表。在Spoke子网内创建VM后，在Azure DNS区域中添加了A记录，但无法在Azure环境中解析该DNS地址。

现有配置 #

Azure防火墙网络规则集合 #

# Create a Azure Firewall Network Rule for DNS
resource "azurerm_firewall_network_rule_collection" "fw-net-dns" {
  name                = "azure-firewall-dns-rule"
  azure_firewall_name = azurerm_firewall.azufw.name
  resource_group_name = azurerm_resource_group.ipz12-dat-np-connection-rg.name
  priority            = 102
  action              = "Allow"

  rule {
    name = "DNS"
    source_addresses = [
      "*",
    ]
    destination_ports = ["53"]
    destination_addresses = [
      "*",
    ]
    protocols = ["TCP","UDP"]
  }
}

路由表配置 #

resource "azurerm_route_table" "azurt" {
  name                          = "AzfwRouteTable"
  resource_group_name           = azurerm_resource_group.ipz12-dat-np-connection-rg.name
  location                      = azurerm_resource_group.ipz12-dat-np-connection-rg.location
  disable_bgp_route_propagation = false

  route {
    name                   = "AzgwRoute"
    address_prefix         = "10.2.3.0/24" // CIDR of 2nd SPOKE
    next_hop_type          = "VirtualNetworkGateway"
  }  

  route {
    name                   = "Internet"
    address_prefix         = "0.0.0.0/0"
    next_hop_type          = "VirtualAppliance"
    next_hop_in_ip_address = azurerm_firewall.azufw.ip_configuration.0.private_ip_address
  }  

  tags = {
    environment = "Staging"
    owner       = "Someone@contoso.com"
    costcenter  = "IT"
  }

  depends_on = [
    azurerm_resource_group.ipz12-dat-np-connection-rg
  ]
}

子网与路由表关联 #

resource "azurerm_subnet_route_table_association" "virtual_machine_subnet_route_table_assc" {
  subnet_id      = azurerm_subnet.virtual_machine_subnet.id
  route_table_id = azurerm_route_table.azurt.id

  depends_on = [
    azurerm_route_table.azurt,
    azurerm_subnet.virtual_machine_subnet
  ]
}

Spoke子网VM配置 #

resource "azurerm_network_interface" "virtual_machine_nic" {
  name                = "virtal-machine-nic"
  location            = azurerm_resource_group.ipz12-dat-np-applications-rg.location
  resource_group_name = azurerm_resource_group.ipz12-dat-np-applications-rg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = data.azurerm_subnet.virtual_machine_subnet.id
    private_ip_address_allocation = "Dynamic"
  }

  depends_on = [
    azurerm_resource_group.ipz12-dat-np-applications-rg
  ]  
}

resource "azurerm_windows_virtual_machine" "virtual_machine" {
  name                = "virtual-machine"
  resource_group_name = azurerm_resource_group.ipz12-dat-np-applications-rg.name
  location            = azurerm_resource_group.ipz12-dat-np-applications-rg.location
  size                = "Standard_B1ms"
  admin_username      = "...."
  admin_password      = "...."
  network_interface_ids = [
    azurerm_network_interface.virtual_machine_nic.id
  ]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "MicrosoftWindowsDesktop"
    offer     = "Windows-10"
    sku       = "21h1-pro"
    version   = "latest"
  }

  depends_on = [
    azurerm_network_interface.virtual_machine_nic
  ]    
}

Azure DNS区域配置 #

resource "azurerm_dns_zone" "dns_zone" {
  name                = "learnpluralsight.com"
  resource_group_name = azurerm_resource_group.ipz12-dat-np-connection-rg.name
  
  depends_on = [
    azurerm_resource_group.ipz12-dat-np-connection-rg
  ]  
}

A记录配置 #

解析失败情况 #

排查与解决步骤 #

1. 确认DNS区域类型与虚拟网络链接

   • 检查DNS区域是否为私有DNS区域：公共DNS区域无法被Azure内部VM默认使用，必须创建私有DNS区域，并关联Hub和Spoke虚拟网络。
   • 若已创建私有DNS区域，确认Spoke虚拟网络已添加到该区域的虚拟网络链接中，按需开启"自动注册"功能。

2. 检查VM所在子网的DNS服务器配置

   • 若使用Azure私有DNS区域，无需修改子网DNS服务器（Azure递归DNS服务器168.63.129.16会自动转发私有域名查询到对应区域）。
   • 若配置了自定义DNS服务器，需确保该服务器能访问Azure私有DNS区域，或已配置转发规则指向168.63.129.16。

3. 验证路由与防火墙规则

   • 检查Azure防火墙是否启用DNS代理：启用后防火墙会缓存DNS请求，需确保防火墙能访问目标DNS服务器。
   • 确认防火墙规则允许出站到168.63.129.16的53端口（Azure递归DNS地址），当前规则虽允许*地址，但需排查是否有优先级更高的拦截规则。

4. 验证DNS记录正确性

   • 检查A记录的名称、IP地址是否匹配Spoke VM的私有IP，无拼写错误。
   • 执行Azure CLI命令验证记录：az network private-dns record-set a show -g <资源组名> -z learnpluralsight.com -n <记录名称>

5. 清理本地DNS缓存

   • 在VM上执行ipconfig /flushdns刷新缓存，再尝试解析。
   • 使用nslookup <FQDN> 168.63.129.16直接指定Azure递归DNS服务器查询，确认解析是否正常。

内容的提问来源于stack exchange，提问作者One Developer