We can connect to our AWS EC2 only from within the company VPN. I made a request to create DNS names for the servers. This would be made using AWS Route 53.
The operations team says that having a DNS name is a security risk and the explanation is
"Names are easy to guess compared to IP addresses"
"setting up a DNS for a sever in the public zone directly exposes the servers origin IP and opens up a potential to the DDOS attacks as well as subnet vulnerability"
The servers are not exposed outside our VPN. We have separate AWS accounts for different teams and public zone here refers to a different team.
Does the operations team have valid argument.
You should create a Route 53 Private Hosted Zone so the DNS name can't be resolved publicly.
You then need to configure the DNS server in the office to incorporate DNS responses from Route 53 by using a forwarder.
I don't know the full details, but here's some articles that should help:
Resolving DNS Queries Between VPCs and Your Network - Amazon Route 53
Resolve a Private Hosted Zone over VPN with Directory Service
Use an Inbound Endpoint to Resolve Records in a Private Hosted Zone From a Remote Network
Related
I was trying to find the IP Address of DNS server hosted in private zone in GCP to resolve some traffic routing related issue on the firewall. But i am not able to find it in Cloud DNS GUI console.
Cloud DNS Private zones require that you use the metadata server for name resolution. Compute Engine instances receive internal DNS resolution information as part of their DHCP leases. By default, the instance's metadata server (169.254.169.254) resolves internal DNS names. If you change the name server configuration for your instance, you cannot resolve records in Compute Engine internal DNS (the .internal zone) or in Cloud DNS managed private zones, forwarding zones, and peering zones unless your replacement DNS server forwards these queries to 169.254.169.254.
I have one privately hosted zone in my vpc using Route 53. I also have one client vpn connection to that vpc, which is functioning normally.
I want the client to get access to my website hosted using private zone in private subnet through their browser when they are connected to the VPN Client.
I have enabled "DNS Configuration" in the Client VPN Settings. But my client is not able to access the hostname of the webitse hosted in the private hosted zone. Though they are able to access the website using client vpn connection but by using ip address. I want them to access it using hostname.
I have tried defining the DNS ip in client vpn settings as
AWS Provided DNS (VPC CIDR + 2)
2.Route 53 inbound endpoint ips.
Both did not work. Help me out on this.
Take a look at this guide, it might be useful for you, but as far as I understand you need to use direct connect or AWS VPN. Cause even if your client is inside the VPC by your custom VPN it still does not use the same DNS resolver https://aws.amazon.com/premiumsupport/knowledge-center/route53-resolve-with-inbound-endpoint/
I'm using Route-53 as a DNS management service.
I have a problem that I'm not really sure how to solve it. I've come here to seek ideas.
I have a partner who wants an IP address of the DNS server, so that they can integrate their on-prem DNS server, to what I'm using(Route-53). This is not possible as Route-53 doesn't give an IP address for accessing the DNS servers. This is because it's a managed service. How can I get IP address for the Route-53 DNS servers so that my integrating partner can use to integrate the DNS server from their end to mine(Route-53)?
I appreciate your advice.
Taken from AWS docs:
10.0.0.2: Reserved by AWS. The IP address of the DNS server is the base of the VPC network range plus two. For VPCs with multiple CIDR blocks, the IP address of the DNS server is located in the primary CIDR. We also reserve the base of each subnet range plus two for all CIDR blocks in the VPC. For more information, see Amazon DNS server.
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html
I'm assuming your hosted zone is private, as if it was public, your partner wouldn't need to do any special configuration (unless they don't allow querying public DNS in their network).
If this is a private DNS, I think what you want is to setup a Route 53 Resolver. Specifically, you would want an inbound endpoint setup in your VPC. This will give you a specific IP address that you can provide to your partner. If you haven't already, you'd then need to configure network routing between your VPC and your partner's network (via a tunnel or peering).
AWS has a couple user guides for this, see below:
Route 53 Resolver Developer Guide
Route 53 Resolver announcement
I have a VPC in my AWS account peered to a VPC of a partners account. The partner account has Route 53 resolvers to resolve DNS within domain.com to IPs in their peered VPC.
I've associated my VPC with their private hosted zone.
Within my VPC (for example SSH into an EC2 instance), the DNS resolution for foo.bar.domain.com works great - I'm resolving & connecting to the resources in their VPC as expected.
However, when I'm running and AWS client VPN on my personal machine, I'm unable to resolve the foo.bar.domain.com to the same private IP address through the VPN. So, for example, running a development server on my machine connected to the partner VPC URLs is failing.
I've tried hosting a DNS server in the VPC with a zone forwarding rule pointing to the Route 53 IPs.
I've tried setting the VPN DNS server IP to the Route 53 IPs.
But none of that has worked. Help would be appreciated?
The answer was simpler than I thought: I just had to set the DNS server in the AWS Client VPN Endpoint settings to be the private IP address of my VPC's DNS (which is always the VPC's CIDR +2).
From the AWS docs:
If you're unsure about which IP address to specify for the DNS servers, specify the VPC DNS resolver at the .2 IP address in your VPC.
Client VPN Endpoints > Modify Client VPN Endpoint > Other optional parameters -> Enable DNS Servers -> IP Address
I have a GCP VPC and it is connected to on-prem using Public Cloud Interconnect.
Traffic flow between onprem and the VPC is ok. All routes and firewalls are configured correctly.
Now I would like to have the company DNS servers available for VMs in my VPC.
My 3 DNS servers are
10.17.121.30 dns-01.net.company.corp
10.17.122.10 dns-02.net.company.corp
10.17.122.170 dns-03.net.company.corp
Now I have done the below config in Cloud DNS in GCP.
The DNS name is company.corp
The "In use by" is referring my VPC.
The IPs 10.17.121.30, 10.17.122.10 and 10.17.122.170 are on-prem and are accessible from the VPC over port 53.
But after having done all the above, if I try to connect to any on-prem machine using its name, I get
telnet: could not resolve example-server.corp.sap/443: No address associated with hostname
The above request is being made from a VM inside the VPC.
Which leads me to believe that my DNS servers might not be correctly configured. What have I missed here ?
If you are intending to have your VMs able to resolve hostnames within your on-premises network, then you will need to make use of DNS forwarding. You would need to configure your private zone as a forwarding zone. Once this is done you can use your forwarding zone to query on-premises servers.