Managing Inbound Endpoints

Scenarios

Inbound endpoints are dedicated access points provided by Huawei Cloud DNS to allow private DNS queries from on-premises data centers, third-party clouds, and branch sites. They enable these external environments to securely access domain names on the cloud. The main use cases are as follows:

• Accessing cloud resources from on-premises data centers or enterprise private networks: On-premises data centers and private servers can use inbound endpoints to resolve private domain names of ECSs and databases in VPCs. Only the DNS port needs to be opened for communication, and Direct Connect is not required.
• Accessing cloud services from branches and stores: Remote branches, stores, and terminals access the cloud through the public network or Direct Connect. Their DNS queries are resolved in a unified manner on the cloud, ensuring consistent domain name resolution for all cloud services. This approach enables convenient access and centralized DNS management and control.
• Secure and restricted interconnection with partners: Partners are not granted direct access to VPCs. Instead, they are given specific DNS resolution permissions through inbound endpoints, allowing them to resolve only the domain names you specify in rules. This ensures secure interconnection with the minimum permissions.
• Unified DNS scheduling for hybrid clouds: On-premises DNS servers can forward DNS requests to inbound endpoints. This integrates local DNS with cloud DNS, creating a unified hybrid-cloud DNS system and making domain name O&M simpler.
• Offline O&M inspection for private network services: The O&M monitoring system resolves private domain names based on inbound endpoints and uses IP address whitelists to restrict access sources, preventing private domain names from being leaked on the public network.

Constraints

• When Enterprise Edition VPN is used together with DNS Resolver, the local subnets of the VPN must contain the IP addresses of the inbound endpoint. Otherwise, the resolution may fail.
• Each account can create a maximum of 50 inbound endpoints. You can submit a service ticket to request an increase.
• The VPC associated with an inbound endpoint cannot be changed after the endpoint is created. This prevents access interruptions caused by misoperations.
• An inbound endpoint cannot be associated with a VPC that contains CloudDCN or CloudPond subnets.

Creating an Inbound Endpoint

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. In the upper right corner of the page, click Create Endpoint.
4. Configure the parameters based on Table 1.
   Figure 1 Creating an inbound endpoint
   

   Table 1 Parameters for creating an inbound endpoint

   Parameter	Description
   Endpoint Type	Type of the endpoint. There are two options: Inbound and Outbound. Select Inbound to allow on-premises servers to access domain names on the cloud.
   Endpoint Name	Name of the endpoint. The name can: Contain only letters, digits, underscores (_), hyphens (-), and periods (.). Contain 1 to 64 characters.
   Region	Region where the inbound endpoint works.
   VPC	The VPC over which all inbound DNS queries are forwarded to cloud DNS servers.
   Subnet	The subnet must have available IP addresses. Only IPv4 addresses are supported.
   IP Addresses	There are two options: Automatically assign or Specify. To improve reliability, you need to specify at least two IP addresses, with each in a different AZ. You can optionally add more IP addresses.

5. Click Create Now.

Viewing an Inbound Endpoint

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. On the Inbound Endpoints tab, locate the inbound endpoint you want to view.
4. Click the name of the inbound endpoint and view its details, such as basic configuration and IP addresses.

Modifying an Inbound Endpoint

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. On the Inbound Endpoints tab, locate the inbound endpoint you want to modify.
4. Click Modify in the Operation column.

   You can change the endpoint name, and add or delete IP addresses.

   

   If only two IP addresses are configured, the IP addresses cannot be deleted.

Deleting an Inbound Endpoint

1. Go to the Resolvers page.
2. Click in the upper left corner and select the desired region and project.
3. On the Inbound Endpoints tab, locate the inbound endpoint you want to delete.
4. Click Delete in the Operation column.
5. Confirm the inbound endpoint and click OK.