I have done the configuration on AWS I'm able to access yourdomain.com(For example) but not able to access http://www.yourdomain.com?
I'm using Amazon EC2 virtual server cloud and route 53 hosted zones.
As Mark B said, your question lacks a lot of the necessary details, however I will answer based on a few assumptions.
1) I'm assuming that your instance is publicly accessible
2) I'm assuming that your instance is not inside a VPC
3) I'm assuming that your instance is not behind a load balancer
First, go to your EC2 instance and copy the public DNS of your instance. IP's can change over time, therefore best practice is to use the public DNS as the value.
Next go to Route 53, and go to the Hosted Zone for your domain and click the blue button that says "Create Record Set".
In the name field put: www
In the type, select: CNAME
In the value field you'll paste the DNS for the EC2 instance
Click create.
If you've done this right, and your security groups are correctly configured, you should be able to now visit your site using www.yourdomain.com.
Below solution worked for me.
Name-www.yourdomain.com Type-CNAME Value-yourdomain.com. (Dot is important)
Related
Use Case
I'm working on an application that uses Presto, and for Presto, I have to set up HTTPS traffic internally (for security compliance reasons).
For this, I preferably need the nodes' FQDN to be in the same domain. E.g. myhost1.mydomain.com, myhost2.mydomain.com.
My Question
AWS automatically gives a FQDN like ip-10-20-30-40.ec2.internal. So, my question is:
Is there a way I can have a new node automatically be created with a FQDN like myhost1.mydomain.com? I know I can create internal "hosted zones" and DNS records for my hosts pretty easily, but I can't figure out how to make that the default domain for a new host.
Also, just FYI, I'm doing this for an auto-scale group; but I suspect that's irrelevant.
When the Amazon EC2 starts, it can run a script passed in via User Data.
You could code this script to create a CNAME record in Amazon Route 53 that points to the IP address of the instance.
I'm not sure how you'd necessarily determine the number within the name, so you could just create a random name. Also, it might be tricky to remove the CNAME entry when the instance is terminated. One way to both assign and remove the record would be to use Amazon EC2 Auto Scaling Lifecycle Hooks, which allows code to be triggered outside of the instance itself. It's more complex but would be fully effective.
I'm not familiar with Presto, but here's a couple of ideas.
First, if you are using an AWS managed load balancer, you can enable HTTPS between it and the instance using self-signed cert: the load balancer will NOT validate the cert, so your connection will be secure.
If that's not what you need, take a look at DHCP option sets for your VPC - I believe you can set your own domain name, rather than use the default ec2.internal.
At our company we have three AWS accounts, the main one, used as "root" account for IAM and hosting an OpenVPN Access Server. The other two accounts are pro and stg. Each one has its own VPC, with different IP ranges, and we have a VPC peering between the root and pro accounts, and other one between root and stg. IP routing is already setup and everything is under control from this side.
(I'm sorry I can't upload images yet, so here you have the link)
VPN+VPC-Peering
The problem comes with DNS resolution. The setup is this one:
I've installed BIND9 in the OpenVPN server, to allow DNS forwarding for private hosted domains, using a configuration like this one in named.conf.local
zone "stg-my-internal-domain.com" IN {
type forward;
forward only;
forwarders { 10.229.1.100;10.229.2.100; };
};
zone "pro-my-internal-domain.com" IN {
type forward;
forward only;
forwarders { 10.228.1.100;10.228.2.100; };
};
And also two Route53 inbound resolvers (a simple BIND server running on each VPC also works) running in 10.229.1.100 and 10.229.2.100 for stg and 10.228.1.100 10.228.2.100 for pro account
VPN clients have OpenVPN profiles that use the Access Server as DNS resolver.
From my client, I can resolve both my-service-1.pro-my-internal-domain.com and my-service-2.stg-my-internal-domain.com perfectly, but the problem comes when I want to resolve internal domain names like the ones that AWS generates inside each VPC with my-service-2.eu-west-1.compute.internal
I know that this is an anti-pattern and I should always use the private domain as much as I can, but for some cases like EMR clusters, YARN and Hadoop managers use links that reference to the internal AWS names, making the resolution impossible.
So my question is: Is there any way to configure DNS to delegate resolution to a secondary address if primary fails?
I could set up a forwarder for the eu-west-1.compute.internal zone using all the accounts resolvers, but
DNS specification says that the secondary nameserver will only be used if the first one is unreachable, so as far as it answers an empty or "unknown" response, it's still a valid response and the second one will not be queried.
Any help is really appreciated!
Why not just change the internal host name to a public dns name? Those services are using the hostname assigned to them of course. You can change it.
See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-hostname.html
You may (or may not) need to assign fixed private ips to each. In any case publish this private IP in a public DNS zone. You should then be able to resolve these names properly. Note you can also have a script run on each instance on startup, to update the hostname and dns record.
For a good discussion on private ip addresses in public DNS, see https://serverfault.com/questions/4458/private-ip-address-in-public-dns
For reference, here is the best answer there:
Some people will say no public DNS records should ever disclose private IP addresses....with the thinking being that you are giving potential attackers a leg up on some information that might be required to exploit private systems. Personally, I think that obfuscation is a poor form of security, especially when we are talking about IP addresses because in general they are easy to guess anyway, so I don't see this as a realistic security compromise. The bigger consideration here is making sure your public users don't pickup this DNS record as part of the normal public services of your hosted application. ie: External DNS lookups somehow start resolving to an address they can't get to. Aside from that, I see no fundamental reason why putting private address A records into the public space is a problem....especially when you have no alternate DNS server to host them on. If you do decide to put this record into the public DNS space, you might consider creating a separate zone on the same server to hold all the "private" records. This will make it clearer that they are intended to be private....however for just one A record, I probably wouldn't bother.
AWS only supports DNS resolution of these internal ipv4 DNS hostnames if your VPN is in the same region as your EMR cluster (or any other compute resource). I have reached out to their Support and they have confirmed this.
For example, I have an AWS Client VPN endpoint setup in Frankfurt and an EMR cluster in Ireland. I am pushing to my host the private DNS server of the VPC (and all other related config is enabled in both VPCs) so that I can resolve private Route53 DNS zone records.
While I am connected to the VPN,
I can't resolve this:
$ dig +short ip-10-11-x-x.eu-west-1.compute.internal
$
But I can resolve the following, which is an instance that's in the same region as the VPN endpoint:
$ dig +short ip-10-10-x-y.eu-central-1.compute.internal
10.10.x.y
How to solve this:
Either move your EMR clusters in the same region as your VPN is, or the other way around.
But the simplest solution might be to just use a Chrome plugin (here's an example) that automatically redirects ip-x-y-z... URLS to x.y.z IPs.
I have 1 hosted zone on Route 53 and have 2 server instances in EC2, one a Windows instance and the other, a Ubuntu instance. I launched the Ubuntu instance and uploaded my website to the proper folders and everything looks good. Now I wish to shutdown the windows instance but need the DNS server to point to my other instance? How to I do that?
I am guessing that I have to enter the Ubuntu instance details in my Route 53?
Snippet of Route 53 details
Update "A" record entries with "Windows" instance public DNS IP (or) Elastic IP (Don't need to modify any NS or SOA) records. That should switch traffic to new box. Note that if you are NOT using Elastic IP, every time you restart (as commented by Sathed, it is shutdown and startup) "instance" you will get new public IP, which you would need to update in Route53 records.
Make sure to have proper security groups applied.
I've (hopefully) successfully set up Cpanel on AWS with clustering following the instructions: https://blog.cpanel.com/part-1-how-i-built-a-cpanel-hosting-environment-on-amazon-aws/
I've been using CPanel/WHM on a dedicated server for a few years before I set up this new Cpanel installation on AWS. My issues comes from how new accounts are set up differently on a dedicated server vs the AWS way.
My first issue:
When I created a new account on my dedicated WHM, I was provided IP Addresses from the server farm that I assigned to newly created accounts. Once assigned, I can access the site with either the IP or the domain name. Now with this new AWS way, there's no info in the tutorials about how I obtain new IP Addresses. I tried adding a new local IP like 10.0.0.30 (because it says it's in NAT mode and use local IP) and assigning this as a dedicated IP to the newly created accounts but I don't understand how anybody can access the site through that IP since its a local IP. So how do I access the domain through custom IP and domain like I did before? I must be missing something fundamental.
My second issue:
On my dedicated WHM after I created a new account, I would typically go to DNS Functions -> Edit DNS Zone and edit the zone to customize my nameserver as so:
mynewdomain.com
ns1.mynewdomain.com
ns2.mynewdomain.com
anothersite.com
ns1.anothersite.com
ns2.anothersite.com
thirdsite.com
ns1.thirdsite.com
ns2.thirdsite.com
and then in my register I would add these custom nameservers into the register and point them to the dedicated IPs of each domain. But with the AWS way, the only way I was able to set this up was to use the new cluster nameservers as the nameserver for ALL accounts in this new WHM installation.
Like this:
mynewdomain.com
ns1.awsnameserver.com
ns2.awsnameserver.com
anothersite.com
ns1.awsnameserver.com
ns2.awsnameserver.com
thirdsite.com
ns1.awsnameserver.com
ns2.awsnameserver.com
Is this the correct / the only way I can set up accounts now through this set up?
Is there a way to have custom nameservers names like I did in dedicated WHM?
In my case, I have a DNS server outside of Amazon so I'm not sure it would answer your question but it might lead you somewhere.
First to figure out what your public IP is you can:
Go to the AWS console and look at the instance detail of your server.
Look for the "endpoint". This points to your public address so you can do a PING or NSLOOKUP to find out what your IP is.
However, AWS does not recommend you hard-coding the public address as it could change. So what I did instead was to create a CNAME in my DNS that points to that "endpoint".
I hope that helps.
I have an RDS instance with a URL that was provided by Amazon. (This URL has an IP that's associated with (of course)).
To make connecting to the DB easier I made a redirect from my domain like this: "db.myDomain.com" to the IP of the DB Instance.
For a week it all worked fine, but then, suddenly, it stopped working. After searching for a few hours, I have realized that the IP I was redirecting to was not the same as the IP of the instance.
This made me think that maybe the IPs on RDS are dynamic and the only way to access the DB is with the URL provided by Amazon.
Is this correct? If so, is there away to redirect from one URL to another?
Yes, your observation about the dynamic nature of the IPs for RDS is correct and it is the anticipated behaviour of the Service. Always use the URL provided for RDS instance to access it RDS instance(s).
For most of the use cases, you don't to do a redirect to access; as the DNS name would go inside a config file / connection string. If you still need a friendly name - you may use the Route53 to create an alias. Here is a documentation link from AWS to accomplish that [ https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-rds-db.html ] - it is easier & convenient.
For RDS instance, the DNS name is not changed, but IP address will be changed in some case, especially when you enable Multi-AZ (multiple available zone), the RDS instance will be switched to other available zone with different IP address when AWS found any fails in it.
So in your application, you can't fix the IP address for your database accessing, always set DNS (domain name) to access your database.