I am having trouble connecting from an Azure Point-to-Site VPN to an Azure Web App via private endpoint.

@kvidhul ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to connect to Private EndPoints from P2S Clients in a vWAN scenario.

Since you mentioned, "i can resolve private endpoint ip address when i am connected via VM in one of the peered virtual networks." and "azure firewall private ip as dns server"

• I take it that you have DNS Proxy enabled and also have a custom DNS server configured in the Azure Firewall
  • i.e.
    
• And also, in the VNET you have specified DNS as the IP of the Firewall
• Azure Firewall Private IP as DNS server would not be able to resolve the Private DNS Zones if it's using Default (Azure provided) in vHub
• Can you confirm if the above observations are correct?
  • If not, please let me know

I see you have mentioned, "Point-to-site vpn is configured with on-premise dns server ip, azure firewall private ip as dns server"

• I believe you have configured custom DNS servers in the P2S Configuration file?
  • Let me know if this is incorrect
• Can you confirm you also added DNS suffixes ?
  • You should use the domain of the PaaS Service without the "privatelink" prefix
  • i.e., you should use ".azurewebsites.net" and not ".privatelink.azurewebsites.net"
• May I ask why the "on-premise dns server ip" is added?
  • Does the OnPrem DNS Server capable of resolving the private endpoint FQDNs?
  • If not, only use the DNS Server in Azure (Azure Firewall private IP)

For more details on how to set this up, see Private endpoints in Azure Virtual WAN.

Kindly answer all the above queries so that we can get a better understanding of your environment

Cheers,

Kapil

Hi KapilAnanth,

Yes, your assumption is correct DNS proxy is enabled and custom dns ips (On-Premise dns server ip) is using for azure firewall and Vnet is using azure firewall private ip as dns server.

So i am using cutom dns ip of on-prem server and azure firewall for vnet dns server, p2s vpn dns configuration.

I have configured custom dns servers for p2s clients from virtual hub "User VPN (point to site) dns configuration settings.

Yes Dns suffixes also included in p2s clients .xml file

<clientconfig>

<dnssuffixes>

      <dnssuffix>.azurewebsites.net</dnssuffix>

</dnssuffixes>

</clientconfig>

Yes, using on-prem dns server ip because legacy applications hosted on-prem which are accessible only on private network. So using it to reach this applications.

Also configured p2s vpn clients to reach internet via azure firewall (InternetSecurtiyFlag -enabled)

I have private dns zone mydnszone.com, privatelink.azurewebsites.net dns zones. i have added A records for custom domains of webapps in mydnszone.com. Still i cannot able to reach webapps from p2s client vpn, even sql servers as well.

Thank you for quick response,

@kvidhul ,

Thanks for sharing the details.

As next steps,

• You can try removing the OnPrem DNS IP from the custom DNS Servers and give it a try
  • If this is not possible, try changing the order of the DNS Servers and make the Private DNS Resolver's Inbound endpoint IP first
• Connect to the P2S and open Powershell to run
  • nslookup <WebAppFQDN> <Inbound endpoint IP>
  • nslookup <WebAppFQDN>
  • ping <WebAppFQDN>
• For debugging, add the IP of the Private endpoint and FQDN in the Host file
  • Once done, try connecting to the WebApp - see if this works
  • Open CMD and run ping <WebAppFQDN>

Please share the outcome from above

Cheers,

Kapil

As per your instructions i have created test resources in a new environment and removed dns servers (used azue provided dns option) and below are the test parameters.

i can RDP to VMs in the vnets using private ip of VMs.

webapp privateink ip 10.0.0.4 (vnet ip address range 10.0.0.0/24) is included in p2s client.

Webapp is still not reachable ping returns public ip, unable to resolve using privatelink.

Vnet-01 - 10.0.0.0/24 with default subnet

Webapp networking with private endpoint and public access disabled.

Azure vpn client is configured to reach vnet ip address range

From my machine with Vpn client is connected

Still no private endpoint ip

Connected to a VM in vnet-01 via private ip and webapp is accessible from the VM.

Also tested with configuring custom dns in Vnet-01 and p2s VPN client

10.0.0.8, 10.0.0.9 are Vnet ip's used as dns server is and 10.5.64.4 is firewall private ip.

In both the configurations (with azure provided dns and custom dns) still cannot able to ping webapp on private endpoint ip.