Configuring DNS name resolution from a private Yandex BareMetal network

A BareMetal server connected to a Virtual Private Cloud cloud network via Yandex Cloud Interconnect is outside Virtual Private Cloud and cannot directly access the cloud network's DNS resolver.

To resolve domain names from internal Yandex Cloud DNS zones on a BareMetal server, create an inbound DNS connection in your cloud network and select it in the DNS settings of the private subnet. The DNS server address will be provided to the BareMetal server over DHCP. If your private UI does not support DHCP, enter the address manually in the OS. You do not need to deploy a separate VM with a DNS forwarder.

In our example, you will configure the resolution of a Yandex Managed Service for PostgreSQL cluster host's FQDN from a private BareMetal network.

To configure DNS name resolution:

1. Prepare the infrastructure.
2. Create an inbound DNS connection.
3. Configure DNS on the BareMetal server.
4. Check DNS name resolution.

If you no longer need the resources you created, delete them.

Prepare your infrastructurePrepare your infrastructure

Sign up for Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or create a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can create or select a folder for your infrastructure on the cloud page.

Learn more about clouds and folders here.

Required paid resourcesRequired paid resources

The infrastructure support cost includes:

• Fee for renting a BareMetal server (see Yandex BareMetal pricing).
• Fee for a Managed Service for PostgreSQL cluster's resources (see Yandex Managed Service for PostgreSQL pricing) if you are using the cluster to check DNS name resolution.

Configure network connectivityConfigure network connectivity

If there is no network connectivity between your private BareMetal subnet and Virtual Private Cloud cloud network, configure it using Cloud Interconnect.

Make sure the virtual router announces the prefix of the Virtual Private Cloud subnet where the inbound DNS connection IP address will reside. The BareMetal server must have a route to this prefix.

The examples below use the following parameters:

• Private BareMetal subnet's CIDR: 172.16.2.0/24.
• BareMetal server IP address: 172.16.2.2.
• Virtual Private Cloud subnet CIDR: 192.168.1.0/24.
• Inbound DNS connection's IP address: 192.168.1.200.

Create a Managed Service for PostgreSQL clusterCreate a Managed Service for PostgreSQL cluster

If you do not have a cloud resource with an FQDN in the internal DNS zone yet, create a Managed Service for PostgreSQL cluster in the cloud network connected to the private BareMetal subnet for testing.

Save the FQDN of one of the cluster hosts. You will need it to check DNS name resolution.

Create an inbound DNS connectionCreate an inbound DNS connection

Create an inbound DNS connection in the cloud network connected to the private BareMetal subnet.

When creating a connection:

1. Select the cloud network connected to the virtual router.
2. Reserve an internal IP address for the connection in the subnet whose prefix is announced by the virtual router, e.g., 192.168.1.200.
3. Wait for the inbound connection to switch its status to AVAILABLE.
4. Save the connection IP address and name. You will need the name to select a connection in the subnet settings, and the IP address, to check DNS name resolution.

Configure DNS on the BareMetal serverConfigure DNS on the BareMetal server

Provide settings over DHCPProvide settings over DHCP

If the server's private UI gets the IP address over DHCP, configure DNS in the private subnet:

1. Open the subnet's DNS settings and enable the DNS server option.
2. In the Domain name server field, select the inbound DNS connection you created.
3. You can leave the Domain name field blank. In this tutorial, we use a cluster host's full domain name.
4. Save the changes and wait up to five minutes until the server receives the settings over DHCP.
5. Check the DNS settings of the private UI. The IP address of the inbound DNS connection should appear in the DNS Servers field. In our example, it is 192.168.1.200.

Configure DNS manuallyConfigure DNS manually

If your private UI does not support DHCP, enter the IP address of the inbound DNS connection manually in the DNS settings of your OS. Save the static IP addresses and interface routes.

Example of setting up DNS using Netplan

In our example, we use a server running Ubuntu 24.04 and the Netplan network configuration.

1. Connect to the BareMetal server via its KVM console or over SSH.

2. Find out the name of the Netplan configuration file:

   ls /etc/netplan/
   

   Result:

   50-cloud-init.yaml
   

3. Open the configuration file:

   sudo nano /etc/netplan/50-cloud-init.yaml
   

4. In the private network interface settings, add the IP address of the inbound DNS connection:

   network:
     version: 2
     ethernets:
       etx1:
         match:
           macaddress: "90:e2:ba:a2:30:de"
         set-name: "etx1"
         nameservers:
           addresses:
             - 192.168.1.200
           search:
             - "~."
   

   Save the rest of the network interface settings unchanged. In the configuration, specify the following:

   • Instead of etx1: Name of the private server network interface.
   • Instead of 90:e2:ba:a2:30:de: MAC address of the private network interface.
   • Instead of 192.168.1.200: Inbound DNS connection's IP address.

   Save the current dhcp4 value, static addresses to addresses, and routes to routes.

   The ~. value in the nameservers.search parameter routes all DNS queries through the inbound DNS connection.

5. Make sure the configuration is correct:

   sudo netplan try
   

   If there are no errors, confirm the changes.

6. Apply the configuration:

   sudo netplan apply
   

7. Make sure the private interface uses the IP address of the inbound DNS connection:

   resolvectl status etx1
   

   The output should contain the connection IP address:

   Link 2 (etx1)
       Current DNS Server: 192.168.1.200
              DNS Servers: 192.168.1.200
               DNS Domain: ~.
   

Warning

Do not edit the /etc/resolv.conf file manually: systemd-resolved can overwrite your changes.

Check DNS name resolutionCheck DNS name resolution

1. Test the accessibility of the inbound DNS connection by sending a query for the cloud resource FQDN to its IP address:

   dig @192.168.1.200 <cloud_resource_FQDN>
   

   The internal IP address of the cloud resource should appear in the ANSWER section.

2. Test the resolution of the same FQDN using the system DNS settings:

   resolvectl query <cloud_resource_FQDN>
   

3. If you created a Managed Service for PostgreSQL cluster for testing, connect to it from the BareMetal server using its FQDN.

How to delete the resources you createdHow to delete the resources you created

To suspend your use of resources:

1. If you provided settings over DHCP, exclude the inbound DNS connection from the settings of all private subnets that use it.
2. If you set up DNS manually, delete the inbound DNS connection's IP address from the Netplan configuration on the BareMetal server and apply the changes.
3. Delete the inbound DNS connection.
4. Delete the reserved internal IP address.
5. If you created a Managed Service for PostgreSQL cluster for testing, delete it.