Managing Outbound Endpoints

Scenarios

Outbound endpoints allow DNS queries from your VPCs to on-premises or third-party DNS based on endpoint rules. The main use cases are as follows:

• DNS queries from the cloud to on-premises DNS: You can configure outbound endpoint rules to forward DNS queries from the cloud to on-premises DNS servers through Direct Connect or VPN. Only DNS communication is enabled, so there is no need to fully interconnect the two private networks.

• Cross-account and cross-VPC private domain name resolution: In a multi-VPC and multi-account environment, requests can be forwarded to the peer DNS for private domain name resolution. The access scope is defined by domain name rules to isolate permissions and schedule cross-VPC resolution in a unified manner.

• Refined cross-region resolution distribution: Specific public domain names can be selectively forwarded to remote or overseas DNS servers for resolution, while other domain names continue to use the default DNS on the cloud. Cross-border access routes are planned to reduce latency and meet compliance requirements.

• Interconnection with upstream enterprise and third-party DNS servers: DNS queries can be forwarded to the enterprise DNS in the headquarters or a third-party recursive DNS. This allows the enterprise to continue using its original global DNS resolution policies, and the existing DNS architecture is seamlessly compatible.

• Cloud-based O&M accessing the local O&M: Cloud-based O&M tools use outbound endpoints to resolve the domain names of local network management systems and O&M hosts. The source IP address whitelist is used to control access sources, protecting on-premises DNS servers from unauthorized access of external networks.

Constraints

• Each account can create a maximum of 50 outbound endpoints. You can submit a service ticket to request an increase.
• After an outbound endpoint is created, the VPC that it belongs to cannot be changed. Only IPv4 addresses are supported. The subnets must have enough IP addresses. To improve reliability, you need to specify at least two IP addresses from different AZs. A subnet CIDR block cannot conflict with the CIDR block of the on-premises data center.
• An outbound endpoint cannot be associated with a VPC that contains CloudDCN or CloudPond subnets.

Creating an Outbound Endpoint

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. In the upper right corner of the page, click Create Endpoint.
4. Configure the parameters based on Table 1.
   Figure 1 Creating an outbound endpoint
   

   Table 1 Parameters for creating an outbound endpoint

   Parameter	Description
   Endpoint Type	Type of the endpoint. There are two options: Inbound and Outbound. Select Outbound to allow cloud servers to access on-premises domain names.
   Endpoint Name	Name of the endpoint. The name can: Contain only letters, digits, underscores (_), hyphens (-), and periods (.). Contain 1 to 64 characters.
   Region	Region where the outbound endpoint works.
   VPC	The VPC over which all outbound DNS queries are forwarded to the IP addresses specified in the endpoint rules.
   Subnet	The subnet must have available IP addresses. Only IPv4 addresses are supported.
   IP Address	There are two options: Automatically assign or Specify. To improve reliability, you need to specify at least two IP addresses, with each in a different AZ. You can optionally add more IP addresses.

5. Click Create Now.

After an outbound endpoint is created, you need to configure endpoint rules. For details, see Modifying an Outbound Endpoint or Adding an Endpoint Rule.

Viewing an Outbound Endpoint

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. On the Outbound Endpoints tab, locate the outbound endpoint you want to view.
4. Click the name of the outbound endpoint and view its details, such as basic configuration, IP addresses, and endpoint rules.

Modifying an Outbound Endpoint

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. On the Outbound Endpoints tab, locate the outbound endpoint you want to modify.
4. Click Modify in the Operation column.

   You can change the endpoint name, add or delete IP addresses, and add or delete endpoint rules.

   

   If only two IP addresses are configured, the IP addresses cannot be deleted.

Deleting an Outbound Endpoint

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. On the Outbound Endpoints tab, locate the outbound endpoint you want to delete.
4. Click Delete in the Operation column.
5. Confirm the outbound endpoint and click OK.