网络课程笔记

00:00 Hi.

00:01 So in this lecture let's understand everything about Amazon VPC, DNS server.

00:05 Now for some historic reason there are different names for the same thing.

00:09 So whether we are talking about Amazon VPC, DNS server or route 53 DNS resolver or local DNS server

00:17 for the VPC or Amazon provided DNS server all means the same.

00:22 Just that because AWS is adding more and more features, the name also got changed over the time.

00:28 But essentially the purpose of this DNS server is to resolve the DNS queries for the resources inside

00:35 the VPC.

00:36 And typically when we say resource, we are talking about the EC2 instances.

00:42 So there is a VPC, there are subnets and then EC2 instances.

00:46 Now if any of these EC2 instance has to resolve some DNS for say google.com or other, if you have multiple

00:54 machines within the same VPC and you want to access that machine over the DNS rather than IP address,

01:00 then how that happens.

01:01 Now, whenever you create a VPC, AWS will also create something called a default DNS server for that

01:09 VPC.

01:10 And this DNS server sits within the VPC.

01:15 But the question is on which IP address does it run?

01:18 So we have talked about this briefly in the earlier session.

01:22 But your route 53 DNS resolver runs on the VPC base address plus two.

01:28 So if your VPC IPv4 cider is ten .1.0.0, then this DNS resolver will run at ten .1.0.2.

01:40 And it can also be accessed over a virtual IP that is 169.254.169.2 53, but note that this IP address

01:52 is only accessible from within the VPC, right?

01:56 So VPC base address plus two as well as this virtual IP.

02:02 Now what is the role of this DNS resolver.

02:04 Of course role is to resolve the DNS queries from the EC2 instances.

02:10 So which all types of the DNS does this DNS resolver resolve?

02:14 So there are typically three categories.

02:17 Very first, if you need to have a private DNS for your VPC resources.

02:21 So in the introductory section we talked about the private DNS where you can have say a domain name

02:28 example.com for your VPC.

02:30 And then for different EC2 instances you can have different domain names.

02:35 For example app one dot example.com, app two dot example.com or db dot example.com.

02:42 Now this you can configure using Amazon route 53 private hosted zone.

02:48 So this DNS server can resolve the private DNS which you configure in the route 53 private hosted zone.

02:56 Other than that it can resolve the Amazon provided DNS names.

03:00 So if you remember, whenever you launch EC2 instance, it gets a private and public DNS names.

03:07 Now, this resolver can also resolve those DNS to corresponding private IPS of the EC2 instances.

03:15 And third, any public DNS name.

03:17 So if these EC2 instances needs to communicate with, say, google.com, then this DNS resolver will

03:24 forward all the public DNS queries to the public DNS server and will get you the IP address.

03:30 Now this is also called as recursive DNS lookup.

03:33 So it can do that.

03:35 And just a thing to mention that whenever we talk about the public DNS, it means everything on the

03:41 internet, including Amazon Route 53 public hosted zone.

03:46 Because public hosted zone contains the publicly resolvable DNS records.

03:51 So that also sits in the internet or public DNS space.

03:57 So this route 53 DNS resolver can also resolve any public DNS queries.

04:03 Right.

04:03 So as I said, it can resolve the DNS from route 53 private Hosted zone or VPC, DNS, which is managed

04:11 by AWS and then any public DNS.

04:15 And one thing to note that it does that in the same order.

04:20 That means, for example, you have google.com as a private hosted zone.

04:26 Then even if you are trying to reach to actual google.com, which is a public DNS, it will not look

04:33 at that.

04:34 It will try to resolve that query from this private hosted zone.

04:38 And we are going to do some exercise around this so that it is clear to you.

04:43 So there is a preference.

04:44 So first it will check the private hosted zone.

04:47 If it exists then it will try to resolve the DNS query from there.

04:51 But if you don't have private hosted zone then it will look at VPC, DNS and if not it will go to the

04:57 public DNS.

04:59 So that's the order.

05:01 And at this moment we are saying that this DNS resolver is accessible only from within the VPC, which

05:08 is not 100% true.

05:10 But just for this lecture, let's try to limit our scope to the VPC only.

05:16 And towards the end of this section we will talk about the resolver end points, which allows this resolver

05:23 to be accessible from outside the VPC network.

05:27 Right.

05:27 So I hope that is clear.

05:29 Now before we move again quickly, every VPC comes with a default DNS server, also called as route

05:34 53 DNS resolver.

05:36 It runs at VPC base address plus two and also available on the virtual IP, and it resolves the DNS

05:44 queries from route 53, private hosted zone, VPC, internal DNS, and any public DNS.

05:51 So with that, now let's try to see how this resolver resolves the DNS queries across these three types

05:58 of the DNS.

06:00 So let's look into that.

06:03 So very first scenario, how does it resolve the DNS queries from Amazon route 53 private hosted zone.

06:10 Now for that, you need to first understand what is route 53 private hosted zone.

06:15 So this is basically a you can say a private DNS for you.

06:18 So if your VPC needs to have its own domain name, for example say example.com.

06:25 And then this first server could be then app dot example.com.

06:29 And the second server could be db dot example.com.

06:32 So in that case app server doesn't need to know the IP address of the DB server.

06:37 Rather it will say db dot example.com.

06:40 It will be resolved using the private hosted zone.

06:43 And then it gets the IP address.

06:45 And then it will connect directly to that DB server.

06:47 So this you can do using Amazon Route 53 private hosted zone.

06:53 So of course you need to first create a private hosted zone.

06:56 And you can use any name for that.

06:59 Just an example.

07:00 I'm using example dot internal.

07:02 But as I said, you can even use google.com as your private hosted zone.

07:08 It doesn't clash with the publicly available google.com.

07:13 Now, once you create the private hosted zone, you have to create the records.

07:18 So in these records, you map your domain name for a particular instance to its private IP address.

07:25 So in this case you will have two records created which you say app one dot example.com which points

07:32 to first ip and app two example.com which points to this second IP, something like this.

07:40 Now at this moment, if first instance wants to communicate with the second instance, it will use the

07:47 DNS name app two dot example dot internal.

07:50 And in that case the DNS query will first go to this DNS resolver.

07:55 It will check if there is a private hosted zone with the name example dot internal, and if it is there,

08:02 then it will try to get the IP address for corresponding record, which is this, and then it will get

08:09 the IP address back.

08:10 It will give that IP address to first instance.

08:13 And first instance now will connect to the second instance.

08:17 Using that private IP address.

08:19 So this is how the entire DNS resolution happens right.

08:23 So I hope that is clear.

08:24 Now let's look at the second scenario.

08:27 Now this is very much AWS managed DNS.

08:30 As I said whenever you create EC2 instance, AWS may assign the private and public DNS names for your

08:37 EC2 instances.

08:38 So that is also resolved by this DNS resolver.

08:42 So the EC2 instance names are typically in the format IP, dash private IP address, then region name,

08:49 dot compute, dot internal.

08:51 And just an example like this or this.

08:55 And then if any of these instance tries to communicate with other instance using this DNS name, they

09:02 can very well do that.

09:04 And in that case the flow will be similar.

09:06 The DNS query goes to the DNS resolver.

09:09 It looks at the VPC DNS records, gets the IP address, and then the instance will connect using that

09:16 IP address.

09:17 Now this is not very helpful I would say because typically you will rather use your own domain name

09:23 rather than using AWS provided DNS name.

09:27 So it makes sense to rather use route 53 private hosted zone instead of using this VPC DNS.

09:35 But I just wanted to, you know, mention it here for the completeness of how it actually works.

09:42 Okay.

09:42 So we saw the two types.

09:44 Now third type is the public DNS which is fairly simple.

09:48 In this case the EC2 instance will actually make a DNS request for any public domain name.

09:55 And this server is available somewhere in the internet.

09:59 Now, in that case, your DNS resolver will make a recursive DNS lookup for, you know, public DNS.

10:06 Now this public machines will be assigned this domain name using some domain registrar.

10:12 And there are so many domain registrar out there.

10:15 Depending on which domain registrar owns this domain name, they will be responsible for resolving this

10:22 DNS queries.

10:23 So here even route 53 public hosted zone sits into this public DNS space.

10:30 So you can have your own public hosted zone.

10:33 And you can create your own DNS records which are resolved over the internet.

10:38 And we are going to talk about this in more detail in the route 53 section.

10:44 So you get the public IP back from the EC2 instance, and then EC2 instance will make direct connection

10:51 to the publicly available server.

10:53 Now just remember that we are not talking about the network layer connectivity between the EC2 and the

11:01 public server.

11:02 For that, of course, your VPC needs to have internet gateway, or if these instances are in the private

11:08 subnet, then you will need Nat gateway.

11:10 All that is given here we are just talking about the DNS resolution.

11:15 And for that if you see you don't need any public connectivity for sending actual traffic, you need

11:23 this internet gateway here.

11:24 So remember this distinction right.

11:28 So we talked about a lot of things though basics but very important for your exam because I'm sure there

11:34 will be some questions around this route 53 DNS resolver.

11:39 Now before we stop for this lecture, I just want to make one more point.

11:42 Now, you know that there is this DNS resolver in every VPC.

11:47 But the question is how does EC2 instance knows that there is this DNS server and it is running on this

11:55 IP address that is VPC base address plus two.

11:58 Now this is a part of Dhcp that is dynamic host control protocol.

12:04 So every VPC comes with some default Dhcp configuration.

12:09 And you can modify this information to change your DNS server.

12:16 By default, VPC will have the configuration, which says that for this VPC, the DNS server is this

12:23 route 53 resolver.

12:25 But as I said you can modify this configuration.

12:28 And all that happens using something called Dhcp option sets.

12:33 So every VPC comes with a default Dhcp option set in which you would have these configurations.

12:41 And in the next lecture we are going to talk in detail about this Dhcp option set.

12:46 But in a nutshell this Dhcp option set tells the VPC resources where to go for DNS queries.

12:54 And in that case that is Amazon provided DNS server, which is nothing but this route 53 DNS resolver.

13:02 So VPC comes with the default Dhcp option set, which provides this dynamic host configuration to the

13:09 instances when they launch.

13:12 And as I said we can change these configurations.

13:15 So that's it about this lecture.

13:16 Now let's look at the Dhcp options sets and other DNS related configurations for your VPC.

13:24 So thanks for watching and stay tuned.