What is DNS Proxy?

• A feature of Azure Firewall that allows us to perform name resolution using Azure Provided DNS or Custom DNS server
• When “DNS proxy” feature is enabled, Firewall listens for DNS query (UDP, port 53) and resolve it using Azure Provided DNS or Custom DNS server
• This functionality is crucial and required to have reliable FQDN filtering in network rules
• It is highly recommended you enable the DNS proxy to ensure name resolution is consistent with your protected virtual machines and firewall

Enable DNS Proxy

• Got to target policy > Settings: DNS > DNS Proxy: select “Enabled”
• If enabled, the Azure Firewalls associated with the policy will listen on port 53 and will forward DNS requests to the DNS specified server (Azure provided or custom)

Set VNet DNS Server

If we have hub-spoke topology, we need to set VNet DNS Server to Firewall private IP for both Hub VNet and Spoke VNet.

Link Private DNS Zones to Hub VNet

Scenario:

• Hub-Spoke topology
• Private endpoints are attched to “PrivateLinkSubnet” of Spoke VNet
• “AzurFirewallSubnet” belongs to Hub VNet

We need to attach Private DNS Zones to Hub VNet to ensure that name resolution will work for private endpoints and private IP of Application Gateway:

• Link Private DNS Zone for Application Gateway private IP
• Link Private DNS Zone for Storage account blob private endpoint
• Link Private DNS Zone for Key Vault private endpoint
• Link Private DNS Zone for ACR private endpoint

Linking a private DNS to Hub VNet

Name Resolution from On-premise

• In order to resolve name resolution using Azure provided DNS, the DNS query must be originated from within the VNet
• When DNS proxy is enabled, Azure Firewall will listen to any DNS query including query coming from on-premises (mentioned that on-premises is connected using ExpressRoute or VPN)
• If on-premises have DNS server, then “conditional forwarding” must be set in on-premises DNS server to forward unknown queries to Firewall private IP:
  • *.hover-system.com
  • *.privatelink.blob.core.windows.net
  • *.privatelink.vaultcore.azure.net
  • *.privatelink.azurecr.io