Integrating Cloud DNS and a corporate DNS service

If you have your own corporate networks connected to internal networks in your Yandex Cloud cloud via Yandex Cloud Interconnect, you can integrate your corporate DNS with Cloud DNS. This will allow you to access resources and services by name, regardless of their location, both in corporate and cloud networks.

You cannot delegate DNS record management in private zones in Yandex Cloud to your DNS servers in the corporate network, because NS records are ignored for private DNS zones. To ensure domain name recognition for cloud network services and resources in private zones, configure separate DNS forwarders in your cloud subnets. DNS forwarders are DNS servers that redirect requests differently depending on the name specified in the request. We recommend CoreDNS or Unbound.

To set up name recognition for corporate services and resources in Yandex Cloud cloud networks:

1. Read an integration example description.
2. Set up cloud DNS.
3. Set up corporate DNS servers.
4. Test the service.

If you no longer need the resources you created, delete them.

Integration exampleIntegration example

1. The corporate network consists of two subnets: 172.16.1.0/24 and 172.16.2.0/24.

2. Each subnet has one DNS server:

   • 172.16.1.5: ns1.corp.example.net
   • 172.16.2.5: ns2.corp.example.net

   These servers serve the corp.example.net DNS zone.

3. The Yandex Cloud cloud network also consists of two subnets:

   • 172.16.3.0/24: subnet3, availability zone ru-central1-d.
   • 172.16.4.0/24: subnet4, availability zone ru-central1-b.

   These subnets host Yandex Cloud DNS servers: 172.16.3.2 and 172.16.4.2.

   These servers serve the cloud network's private DNS zones.

4. The corporate and cloud networks are interconnected so that all subnets of one network are accessible from subnets of the other network, and vice versa.

Next, you need to set up two DNS forwarders in the cloud network:

• 172.16.3.5: forwarder1.internal
• 172.16.4.5: forwarder2.internal

They will redirect DNS requests as follows:

• Requests to the corp.example.net zone via corporate DNS servers 172.16.1.5 and 172.16.2.5.
• Other requests (to zone .) via internal Yandex Cloud DNS servers to the corresponding subnets: 172.16.3.2 and 172.16.4.2.

To ensure fault tolerance for DNS forwarders, they will be placed behind the internal network load balancerYandex Network Load Balancer. All requests to DNS forwarders (both from the cloud network and from the corporate network) will pass through this load balancer.

Getting startedGetting started

1. To install DNS forwarders in each cloud subnet, subnet3 and subnet4, create a VM from a Ubuntu 20.04 public image with the following parameters:

   • Name:
     • forwarder1 for the VM in subnet3.
     • forwarder2 for the VM in subnet4.
   • Under Network settings:
     • Public IP: No address.
     • Internal IPv4 address: Select Manual and specify:
       • 172.16.3.5 for forwarder1.
       • 172.16.4.5 for forwarder2.

2. To connect from the internet and check the service in subnet4, create another VM instance from the Ubuntu 20.04 public image, with the following parameters:

   • Name: test1.
   • Under Network settings:
     • Public IP: Auto.
     • Internal IPv4 address: Auto.

3. To install software from the internet in subnet3 and subnet4, set up a NAT gateway.

Required paid resourcesRequired paid resources

The infrastructure support costs include:

• Fee for a continuously running VM (see Yandex Compute Cloud pricing).
• Fee for using a dynamic or static external IP address (see Yandex Virtual Private Cloud pricing).
• Fee for using a network load balancer (see Yandex Network Load Balancer pricing).

Set up cloud DNSSet up cloud DNS

1. Set up DNS forwarders.
2. Set up the network load balancer.
3. Set up DHCP.

Set up DNS forwardersSet up DNS forwarders

Set up the Network Load Balancer network load balancerSet up the Network Load Balancer network load balancer

Create an internal network load balancer with the following parameters:

• Type: Internal.

• Under Listeners:

  • Subnet: Select subnet3 from the list.
  • Protocol: UDP.
  • Port: 53.
  • Target port: 53.

• Under Target groups:

  • Create a group consisting of hosts forwarder1 and forwarder2.

  • Under Health check, specify the parameters:

    CoreDNS

    Unbound

    • Type: HTTP.
    • Path: /health.
    • Port: 8080.

    • Type: TCP.
    • Port: 53.

When you create a load balancer, it will automatically get an IP address from subnet3.

Set up DHCPSet up DHCP

For your cloud network hosts to automatically use the corporate DNS service, specify the following in the DHCP settings for subnet3 and subnet4:

1. Domain name servers: IP address that was assigned to the load balancer.
2. (Optional) Domain name: corp.example.net.

To update the network settings on the forwarder1, forwarder2, and test1 hosts, run the following command:

sudo netplan apply

Once the network settings are updated, the hosts in the cloud network will use the load balancer instead of the Yandex Cloud DNS server.

Set up corporate DNS serversSet up corporate DNS servers

Configure the corporate servers so that DNS queries to the Yandex Cloud private zones private zones are forwarded to the IP address that was assigned to the load balancer.

Test the serviceTest the service

1. Check that domain names are resolved in the corp.example.net private zone on cloud hosts forwarder1, forwarder2, and test1:

   host ns1.corp.example.net
   ns1.corp.example.net has address 172.16.1.5
   

2. Check that domain names are resolved in public zones on cloud hosts forwarder1, forwarder2, and test1, for example:

   host cisco.com
   cisco.com has address 72.163.4.185
   ...
   

3. Check that internal Yandex Cloud names are resolved on corporate DNS servers ns1 and ns2, for example:

   host ns.internal
   ns.internal has address 10.130.0.2
   

4. To make sure that the services start up automatically, restart the forwarder1, forwarder2, and test1 VMs and repeat the checks.

How to delete the resources you createdHow to delete the resources you created

To stop paying for the resources:

• Delete the VM.
• Delete the static public IP addresses if you reserved them specifically for your VMs.
• Delete the target groups.
• Delete the listeners.
• Delete the network load balancer.
• Delete the subnets.
• Delete the route table.
• Delete the NAT gateway.
• Delete the networks.