Configuring DNS name resolution from a private Yandex BareMetal network

A BareMetal server connected to a Virtual Private Cloud cloud network via Yandex Cloud Interconnect is outside Virtual Private Cloud and cannot directly access the cloud network's DNS resolver.

To resolve domain names from internal Yandex Cloud DNS zones on a BareMetal server, create an inbound DNS connection and specify its IP address as the DNS server on your BareMetal server. You do not need to deploy a separate VM with a DNS forwarder.

In out example, you will configure resolving of a Yandex Managed Service for PostgreSQL cluster host's FQDN from a private BareMetal network.

To configure DNS name resolution:

1. Set up your infrastructure.
2. Create an inbound DNS connection.
3. Configure DNS on the BareMetal server.
4. Check DNS name resolution.

If you no longer need the resources you created, delete them.

Set up your infrastructureSet up your infrastructure

Sign up for Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or create a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can create or select a folder for your infrastructure on the cloud page.

Learn more about clouds and folders here.

Required paid resourcesRequired paid resources

The infrastructure support cost includes:

• Fee for renting a BareMetal server (see Yandex BareMetal pricing).
• Fee for a Managed Service for PostgreSQL cluster's resources (see Yandex Managed Service for PostgreSQL pricing) if you are using the cluster to check DNS name resolution.

Configure network connectivityConfigure network connectivity

If there is no network connectivity between your private BareMetal subnet and Virtual Private Cloud cloud network, configure it using Cloud Interconnect.

Make sure the virtual router announces the prefix of the Virtual Private Cloud subnet where the inbound DNS connection IP address will reside. The BareMetal server must have a route to this prefix.

The examples below use the following parameters:

• Private BareMetal subnet's CIDR: 172.16.2.0/24.
• BareMetal server IP address: 172.16.2.2.
• Virtual Private Cloud subnet CIDR: 192.168.1.0/24.
• Inbound DNS connection's IP address: 192.168.1.200.

Create a Managed Service for PostgreSQL clusterCreate a Managed Service for PostgreSQL cluster

If you do not have a cloud resource with an FQDN in the internal DNS zone yet, create a Managed Service for PostgreSQL cluster in the cloud network connected to the private BareMetal subnet for testing.

Save the FQDN of one of the cluster hosts. You will need it to check DNS name resolution.

Create an inbound DNS connectionCreate an inbound DNS connection

Create an inbound DNS connection in the cloud network connected to the private BareMetal subnet.

When creating a connection:

1. Select the cloud network connected to the virtual router.
2. Reserve an internal IP address for the connection in the subnet whose prefix is announced by the virtual router, e.g., 192.168.1.200.
3. Wait for the inbound connection to switch its status to AVAILABLE.
4. Save the connection IP address. You will need it to configure the BareMetal server.

Configure DNS on the BareMetal serverConfigure DNS on the BareMetal server

In our example, we use a server running Ubuntu 24.04 and the Netplan network configuration.

1. Connect to the BareMetal server via its KVM console or over SSH.

2. Find out the name of the Netplan configuration file:

   ls /etc/netplan/
   

   Result:

   50-cloud-init.yaml
   

3. Open the configuration file:

   sudo nano /etc/netplan/50-cloud-init.yaml
   

4. In the private network interface settings, disable using DNS servers received via DHCP and add the IP address of the inbound DNS connection:

   network:
     version: 2
     ethernets:
       etx1:
         match:
           macaddress: "90:e2:ba:a2:30:de"
         dhcp4: true
         dhcp4-overrides:
           use-dns: false
         set-name: "etx1"
         nameservers:
           addresses:
             - 192.168.1.200
           search:
             - "~."
   

   Save the rest of the network interface settings unchanged. In the configuration, specify the following:

   • Instead of etx1: Name of the private server network interface.
   • Instead of 90:e2:ba:a2:30:de: MAC address of the private network interface.
   • Instead of 192.168.1.200: Inbound DNS connection's IP address.

   The ~. value in the nameservers.search parameter routes all DNS queries through the inbound DNS connection.

5. Make sure the configuration is correct:

   sudo netplan try
   

   If there are no errors, confirm the changes.

6. Apply the configuration:

   sudo netplan apply
   

7. Make sure the private interface uses the IP address of the inbound DNS connection:

   resolvectl status etx1
   

   The output should contain the connection IP address:

   Link 2 (etx1)
       Current DNS Server: 192.168.1.200
              DNS Servers: 192.168.1.200
               DNS Domain: ~.
   

Check DNS name resolutionCheck DNS name resolution

1. Test the accessibility of the inbound DNS connection by sending a query for the cloud resource FQDN to its IP address:

   dig @192.168.1.200 <cloud_resource_FQDN>
   

   The internal IP address of the cloud resource should appear in the ANSWER section.

2. Test the resolution of the same FQDN using the system DNS settings:

   resolvectl query <cloud_resource_FQDN>
   

3. If you created a Managed Service for PostgreSQL cluster for testing, connect to it from the BareMetal server using its FQDN.

How to delete the resources you createdHow to delete the resources you created

To suspend your use of resources:

1. Delete the inbound DNS connection's internal IP address from the Netplan configuration on the BareMetal server and apply the changes.
2. Delete the inbound DNS connection.
3. Delete the reserved internal IP address.
4. If you created a Managed Service for PostgreSQL cluster for testing, delete it.