Proxy appliance as an internet proxy: How DNS works?

[chrisflyckelen]

Hi everyone,

I have a question about using the proxy appliance as an internet proxy for VMs running inside a Veeam Virtual Lab.

I enabled the internet access feature and configured HTTPS traffic on port 443. On a VM within the isolated network, I then configured the isolated-network IP address of the proxy appliance and the corresponding port as a proxy server in the web browser.

However, internet access is not working.

While troubleshooting, I started wondering how DNS resolution is supposed to work in this scenario. Typically, the VM sends DNS queries to an internal DNS server. If the requested hostname cannot be resolved locally, the DNS server forwards the query to an external DNS forwarder.

Since the proxy appliance only proxies the web traffic, how are DNS queries from the isolated environment handled? Does the internal DNS server require a separate route or masquerading rule for external DNS resolution, or is DNS resolution handled by the proxy appliance as part of the proxy connection?

Could someone explain the expected DNS and traffic flow in this setup?

Thank you,
Christian

[vnikiforov]

Hello, Christian,

With an explicit proxy, the browser never contacts or resolves the target site itself. It connects to the proxy (the appliance's isolated-network IP and the port set at the Proxy step of the virtual lab settings, 8080 by default) and passes the target hostname inside the request; for HTTPS this is a CONNECT request. The appliance resolves that name with the DNS servers configured on its production interface and returns the result to source - that is roughly the whole concept of the proxy service. So DNS is handled by the appliance as part of the proxy connection, and your internal DNS server needs no external route or masquerading rule for this to work.

The appliance does not proxy other protocols (it's not a tunnel or socks5 proxy), so that means no ICMP or ping - this is not a valid test; configure the browser exactly as shown in KB1165. If internet access still does not work with all of that in place, please open a support case, so engineers would check the logs and advise.