← Developers
Level 0: resolver Environment
Azure
Set the VNet DNS servers to the assigned Securd resolvers and deny port 53 to other destinations with an NSG rule.
Configuration and reference code for Azure
Terraform
main.tf
resource "azurerm_virtual_network" "agents" {
name = "agents-vnet"
address_space = ["10.40.0.0/16"]
location = var.location
resource_group_name = var.rg
dns_servers = [var.securd_primary, var.securd_secondary]
}
resource "azurerm_network_security_rule" "allow_securd_dns" {
name = "allow-securd-dns"
priority = 100
direction = "Outbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "53"
source_address_prefix = "*"
destination_address_prefixes = [var.securd_primary, var.securd_secondary]
resource_group_name = var.rg
network_security_group_name = azurerm_network_security_group.agents.name
}
resource "azurerm_network_security_rule" "deny_other_dns" {
name = "deny-other-dns"
priority = 110
direction = "Outbound"
access = "Deny"
protocol = "*"
source_port_range = "*"
destination_port_range = "53"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = var.rg
network_security_group_name = azurerm_network_security_group.agents.name
}
Evaluate Agent DNS with your own agent traffic
Deploy on a single policy in learning mode and review the recorded destinations with your team.