Secure Open AI model and connect via Azure VPN only

To securely connect to your Azure OpenAI model via Azure VPN and ensure it is not accessible from all networks, follow these steps:

1. VPN Gateway Configuration: Ensure your VPN Gateway is correctly set up for Point-to-Site (P2S) connections. You should have the VPN Client configuration ready.
2. Private Endpoint: You've already created a Private Endpoint and linked it to a Private DNS Zone. This is essential for ensuring that the Azure OpenAI resource is only accessible through the private network.
3. DNS Configuration: Make sure that your DNS settings are correctly configured. The DNS private resolver should be able to resolve the private endpoint's DNS name to its private IP address. You mentioned that when you perform an nslookup, you receive the public IP instead of the private IP. This indicates that the DNS resolution is not correctly pointing to the private endpoint.
4. Custom DNS Servers: If you are unable to set vpnClientDnsServers or customDnsServers configurations manually, ensure that your VPN Gateway is configured to use the DNS servers of your virtual network. You may need to check the settings in the Azure portal under your VPN Gateway's configuration.
5. Hosts File Configuration: As a workaround, you can manually configure the hosts file on your local machine to point the Azure OpenAI resource's hostname to its private IP address. This can help in bypassing the DNS resolution issue temporarily.
6. Testing Connectivity: After making these changes, test the connection again using nslookup to ensure it resolves to the private IP. If it still resolves to the public IP, double-check the DNS settings and the private endpoint configuration.

If the problem persists, consider reviewing the Azure documentation or reaching out to Azure support for more tailored assistance regarding your specific setup and configurations.

Hello Sreeni Chozhankandath

I see that you're attempting to establish a secure connection to the Azure OpenAI model but are experiencing difficulties.

First, test the nslookup on the source machine to see if it resolves privately. If it doesn't, check if the Private Endpoint VNET and DNS resolver VNET is linked to the private DNS zone. And also, please test it form the inside azure VM and see it is working or not. Share the nslookup results with us.

If you're using custom DNS in the private endpoint VNET, set a forwarder in the custom DNS server to point to the Azure DNS IP (168.63.129.16). Also, verify if the custom DNS and private endpoint are in the same VNET or different VNETs. If they are in different VNETs, you need to link both VNETs in the private DNS zone.

Additionally, test psping on the source machine to check if connectivity is working.

Command: [ psping privateIp:portno ]

Refer to the following public document for Psping

Check the below document for more understanding:

https://github.com/msrini-MSFT/Troubleshooting-Private-Link-DNS-Scenarios?tab=readme-ov-file#scenario-1--source-machine-deployed-in-azure

Also, please delete the P2S VPN gateway client file from your source machine, reinstall it, and then try configuring a record in the client file. Make sure to add the Private DNS resolver inbound IP to the VPN gateway client file and test it.

Please try to check the below reference documents:
https://learn.microsoft.com/en-us/answers/questions/2259152/how-can-i-test-connection-to-azure-ai-foundry-priv

https://learn.microsoft.com/en-us/answers/questions/2245617/cannot-connect-to-the-private-endpoint-of-an-azure

Hope the above answer helps!

Please let us know do you have any further queries. Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.