VPN Gateway & DNS Private Resolver Setup

Post-deployment add-on for private network templates (T10, T15–T19). Creates a point-to-site VPN Gateway and DNS Private Resolver so the user can connect from their dev machine and resolve private DNS zones.

Assumptions

Subnet Layout

Adds two subnets to the existing VNet. Uses the next available range after the agent and PE subnets.

⚠️ Warning: GatewaySubnet is a reserved name — Azure requires this exact name for VPN Gateway.

Pre-Deployment

1. Discover Available Subnets

List existing subnets to find free address space:

az network vnet subnet list \
  --resource-group <rg> --vnet-name <vnet-name> \
  --query "[].{name:name,cidr:addressPrefix}" -o table

Pick the next unused /24 for GatewaySubnet and the next unused /28 for dns-resolver-inbound. Both must not overlap with any existing subnet.

Example: if subnets .0.0/24, .1.0/24, .2.0/24 are in use → use 192.168.3.0/24 for GatewaySubnet, 192.168.4.0/28 for dns-resolver-inbound.

2. Collect Remaining Inputs

3. Check VPN Gateway Quota

az network list-usages --location <location> \
  --query "[?name.value=='VirtualNetworkGateways'].{limit:limit,current:currentValue}" -o table

Bicep Template

Template: vpn-dns-setup.bicep

Creates: GatewaySubnet, dns-resolver-inbound subnet, Public IP (zonal), VPN Gateway (VpnGw1AZ, P2S AAD/OpenVPN), DNS Private Resolver with inbound endpoint.

Deploy

az deployment group create \
  --resource-group <rg> \
  --template-file vpn-dns-setup.bicep \
  --parameters vnetName='<vnet-name>' aadTenantId='<tenant-id>' suffix='<suffix>' \
    gatewaySubnetCidr='<computed-cidr>' dnsResolverSubnetCidr='<computed-cidr>' \
  --name vpn-dns-setup

⚠️ VPN Gateway provisioning takes 20–45 minutes. This is normal. Do not cancel.

Monitor:

az deployment group show \
  --resource-group <rg> --name vpn-dns-setup \
  --query "{state:properties.provisioningState}" -o tsv

Post-Deployment

1. Get DNS Resolver Inbound IP

az network dns-resolver inbound-endpoint show \
  --resource-group <rg> \
  --dns-resolver-name dns-resolver-<suffix> \
  --name inbound \
  --query "ipConfigurations[0].privateIpAddress" -o tsv

Save this IP — the VPN client needs it as custom DNS.

2. Connect via VPN

Provide the user with these instructions (substitute actual resource name and DNS IP):

1. Go to Azure Portal → vpn-gateway-<suffix> → Point-to-site configuration → Download VPN client
2. Extract the ZIP → edit AzureVPN/azurevpnconfig.xml — replace:

   <clientconfig i:nil="true" />

with:

   <clientconfig>
     <dnsservers>
       <dnsserver><dns-resolver-inbound-ip></dnsserver>
     </dnsservers>
   </clientconfig>

1. Open Azure VPN Client → Import the modified azurevpnconfig.xml → Connect

Use AskUserQuestion: "Let me know when you're connected so I can verify DNS resolution."

Do NOT proceed to verification until the user confirms they are connected.

3. Verify DNS Resolution

After connecting via VPN, verify private DNS zones resolve correctly:

nslookup <ai-account-name>.services.ai.azure.com
nslookup <cosmos-account>.documents.azure.com
nslookup <storage-account>.blob.core.windows.net

Each should resolve to a private IP (192.168.x.x), not a public IP.

4. VPN Setup Complete

DNS resolves to private IPs — VPN is working. Return to post-deployment-validation.md Step 5 to run the end-to-end tests.

Troubleshooting