DNS Resolver Overview

What Is DNS Resolver?

DNS Resolver answers DNS queries to and from your on-premises data center after your data center is connected to the cloud over Direct Connect or VPN.

Generally, on-premises data centers can access cloud resources over a Direct Connect or VPN connection. However, for security purposes, on-premises servers are not allowed to access the DNS service on the cloud directly. If your on-premises servers need to access private domain names used within VPCs, or your cloud servers use Huawei Cloud private DNS to access an on-premises domain name, you need to set up DNS on your cloud servers for forwarding DNS queries between the cloud DNS and on-premises DNS. This increases management and maintenance costs and causes reliability risks.

Cloud vendors typically use IP address ranges starting with 100 for cloud services and ranges starting with 10, 172, and 192 for compute resources. When an on-premises network connects to multiple cloud vendor networks, there may be IP address range conflicts. If an on-premises resource or a third-party cloud service also uses IP address ranges starting with 100, you must add an exact route for each IP address used to avoid route conflicts. This significantly increases the maintenance workload. If both sides use the same IP addresses, the required routes cannot be configured.

DNS Resolver translates IP addresses starting with 100 to private IP addresses used in VPCs. On-premises resources can directly access the private IP addresses used in VPCs, and they do not need to access IP addresses starting with 100, which greatly simplifies the networking architecture. If a customer uses Direct Connect or VPN to set up a hybrid cloud, they only need to create inbound and outbound endpoints and associate VPCs with these endpoints to resolve DNS queries between the on-premises network and VPCs. If a third-party DNS requests access to a domain name hosted on a cloud, inbound endpoints allow DNS queries to the VPCs from that third-party DNS. Conversely, if a VM on the cloud seeks to access a third-party domain name, an outbound endpoint with rules configured can forward DNS queries to the on-premises network or third-party cloud. In this way, on-premises and cloud services can easily communicate with each other in hybrid cloud scenarios.

Figure 1 DNS Resolver networking

DNS Resolver is now available in CN North-Ulanqab1, CN East2, CN Southwest-Guiyang1, AP-Bangkok, AP-Singapore, AP-Jakarta, AP-Manila, CN-Hong Kong, AF-Cairo, LA-Sao Paulo1, TR-Istanbul, AF-Johannesburg, ME-Riyadh, LA-Mexico City2, and LA-Santiago.

Video

This video introduces the main functions of Huawei Cloud DNS Resolver and how to use DNS Resolver to set up DNS for a hybrid cloud.

Constraints

• Both inbound and outbound endpoints do not support DNSSEC.
• By default, cloud servers use private DNS for domain name resolution. Do not change private DNS addresses, or endpoint rules will not be applied.
• DNS Resolver cannot be associated with a VPC that contains CloudDCN or CloudPond subnets.

Where to Use

• To enable on-premises servers to access a cloud service domain name, you need to create an inbound endpoint and configure endpoint rules on the on-premises DNS servers to forward the DNS queries for the cloud service domain name to the IP addresses specified in the inbound endpoint.

  For details, see Managing Inbound Endpoints.

• To allow cloud servers to access an on-premises domain name, you need to create an outbound endpoint and configure endpoint rules to specify the on-premises domain name to be accessed and the IP addresses of the on-premises DNS servers. Huawei Cloud private DNS then forwards the DNS queries for the on-premises domain name to the on-premises DNS servers based on the endpoint rules.

  For details, see Managing Outbound Endpoints.