CODEWITHSUNDEEP
azure-sql-databaseazure-virtual-networkazure-appserviceazure-private-link
user472292
user472292

Reputation: 329

Azure - Private Link Between Virtual Networks

I have two virtual networks: public and private. On the public vnet there is an app service. On the private vnet there is an azure sql database. The azure sql database has public access blocked and is exposing a private link. The two vnets are peered. The private dns zone for the private link has both vnets linked.

When I VPN to the private vnet I can connect to the private link no problem. When I try to connect via the app service I get an error:

SqlException: Reason: An instance-specific error occurred while establishing a connection to SQL Server. Connection was denied since Deny Public Network Access is set to Yes (https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings#deny-public-network-access). To connect to this server, use the Private Endpoint from inside your virtual network (https://learn.microsoft.com/azure/sql-database/sql-database-private-endpoint-overview#how-to-set-up-private-link-for-azure-sql-database).

It seems like the app service is using the public IP address (thus the error) as opposed to seeing the private IP address (via the private dns zone).

How can I set up the azure app service to connect via private link across vnets?

Update: My app service is using Docker. I ssh'ed into it and saw that the dns name was resolving to the public IP address. I temporarily added the IP to the hosts file (the private IP), but I still get the same error.

Upvotes: 0

Views: 1018

Answers (2)

user472292
user472292

Reputation: 329

On the configuration page of your app service you need to add the following app settings:

WEBSITE_DNS_SERVER with value 168.63.129.16 WEBSITE_VNET_ROUTE_ALL with value 1

Upvotes: 0

Martin Cairney
Martin Cairney

Reputation: 1767

This smells more like a networking or DNS issue rather than specific to Private Link on the Azure SQL DB.

As you can SSH into your App container, can you try some network tests from there such as TRACERT to see whether it is resolving the private IP correctly and also has a suitable route in place between the virtual networks.

Haver you also checked NSGs on each virtual network to ensure that port 1433 is alloed to pass between them?

Upvotes: 0

Related Questions