Lecture 35: Hands On: VPC DNS with custom DNS server
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：11:02
- 来源：Udemy Lecture 33190000
- Slide 数量：14
- 画面切换：00:19、01:14、02:14、02:52、03:59、05:03、06:21、06:22、06:24、06:51、07:58、09:11、10:52
扫描说明
按 Udemy Transcript 的 162 个时间点逐一定位并比较视频画面，并对 03:58–06:26 的终端配置与快速步骤回顾做额外密集复核。确认 7 个正式 Slide（含仅短暂出现的 Step 2a、Step 2c）以及 7 个控制台/终端阶段，共 14 小节；截图均保留完整视频区域。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC DNS with a Custom DNS Server
时间范围：00:00–00:19
总结 / Summary
中文
本实验不使用 Amazon 提供的 DNS（AmazonProvidedDNS），而是在 VPC 中自行部署 DNS 服务器（Custom DNS Server），并让它负责 VPC 私有名称解析（Private DNS Resolution）。
English
This lab replaces AmazonProvidedDNS with a self-managed DNS server inside the VPC and uses it for private DNS resolution.
Transcript
00:00 Hi.
00:00 So in this exercise, let's try the second scenario where we'll be using the custom DNS server to configure
00:07 and resolve our VPC private DNS now, which means we are not going to use Amazon provided DNS server,
00:15 but rather set up our own DNS server inside the VPC.
2. Target Custom DNS Architecture
时间范围：00:19–01:14
总结 / Summary
中文
VPC 中增加一台 DNS EC2 实例，DHCP 选项集（DHCP Option Set）的名称服务器指向它的私有 IP。自建服务器维护 corp.internal 区域文件（Zone File），把应用与数据库名称映射到各自私有 IP；VPC 内客户端能够直接通过私有网络访问该 DNS 服务器。
English
An additional EC2 instance acts as the DNS server, and the DHCP option set points clients to its private IP. The server hosts the corp.internal zone file that maps application and database names to private addresses, and all VPC clients can reach it over the private network.
Transcript
00:19 So at high level the setup will look something like this.
00:22 Where inside a VPC, we will also have another EC2 instance which will act as our DNS server.
00:29 And we then have to modify the Dhcp option set where we will point this Dhcp option set to this DNS
00:38 server when it comes to the name server, so that all the DNS queries from the EC2 are directed to this
00:45 DNS server, and this DNS server will have corresponding zone file, which has the entries for mapping
00:52 this app server and database server to corresponding private IP addresses of this EC2 instances and
00:59 all these machines can natively reach to this DNS server because all this communication is within the
01:05 VPC, right.
01:06 So this is what we want to implement.
01:08 So now let's look at our setup and all the steps that we are going to perform okay.
3. Step 1: Build the VPC and Instance Setup
时间范围：01:14–02:14
总结 / Summary
中文
实验准备一个 VPC、公有/私有子网以及应用、数据库和 DNS 三台实例。演示为了便于配置把应用与 DNS 实例放在公有子网（Public Subnet），数据库放在私有子网（Private Subnet）；生产设计可以全部使用私有子网。安全组（Security Group）为应用开放 SSH 与 ICMP，并为 DNS 服务器额外开放 UDP 53。
English
The lab prepares a VPC with public and private subnets and three instances: application, database, and DNS. For convenient configuration, the application and DNS instances are public while the database is private, although a production design can keep everything private. Security groups allow SSH and ICMP as needed and additionally allow UDP port 53 to the DNS server.
Transcript
01:14 So setup is pretty simple.
01:16 Um we'll just have a couple of machines inside VPC.
01:19 Now I'm launching these machines in public subnet because I want to connect and configure, uh, these
01:24 machines.
01:25 But in real setup you could have everything into the private subnets.
01:29 Now you need to just create VPC and three machines as I'm showing here.
01:34 Uh, just make sure when you open the security group rules, uh, you, uh, have the appropriate ports
01:40 open.
01:41 So for app server, we just need to have SSH open and ICMP protocol open.
01:47 And for DNS server, uh, apart from this we also need uh UDP 53, which is uh port for DNS.
01:55 Right.
01:56 Because all these servers are going to send the DNS queries to this server.
01:59 So that's the only thing you need to remember.
02:02 Now, what I did is uh, I already created this setup to save some time.
02:06 So I have VPC and public subnet, private subnet and all these three EC2 instances.
02:10 Let me quickly show you that in my console okay.
4. Inspect the Prepared VPC and EC2 Instances
时间范围：02:14–02:52
总结 / Summary
中文
控制台确认 VPC CIDR 为 10.10.0.0/16，公有子网带互联网路由，私有子网只有本地路由，并已连接互联网网关（Internet Gateway）。应用与 DNS 实例拥有公有 IP，数据库实例仅有私有 IP。
English
The console confirms a 10.10.0.0/16 VPC, a public subnet with an Internet route, a private subnet with only the local route, and an attached Internet Gateway. The application and DNS instances have public IPs, while the database instance has only a private IP.
Transcript
02:14 So this is my VPC.
02:15 You can see the IP address range is 1010 zero zero 16.
02:19 Then I have two subnets inside this VPC one public.
02:22 And you can see the routes.
02:24 And then one private which has just um local route.
02:29 Um that's it.
02:30 I have internet gateway attached.
02:32 And then I have three EC2 machines created.
02:35 And uh, app server and DNS server are in public subnet and also have public IPS DB server is in private
02:44 subnet does not have uh, public IP.
02:46 So essentially that's what um, we have.
02:49 Now let's follow the next steps.
5. Connect to the DNS Instance and Install BIND
时间范围：02:52–03:59
总结 / Summary
中文
通过 SSH 登录 DNS 实例、切换到 root、更新软件包并安装 BIND（Berkeley Internet Name Domain）及 bind-utils。DNS 安全组必须允许来自 VPC 客户端的 UDP 53 查询。
English
The lab SSHs to the DNS instance, switches to root, updates packages, and installs BIND and bind-utils. The DNS security group must allow UDP port 53 queries from VPC clients.
Transcript
02:52 The first step is to create a DNS server and configure it.
02:56 So let me connect to this DNS server.
02:59 I'll grab its public IP and I'll just open a session.
03:06 So I already have my partition ssh key loaded, and I'm just logging in there.
03:16 Okay, let me change my cell to root.
03:18 Now for configuring the DNS server you need to install some packages.
03:22 So that's where I change myself to root.
03:24 And then you need to make sure that you have the latest packages.
03:28 So let's do jump date minus y.
03:32 It will fetch the latest yum packages and install okay.
03:37 Now let's install the packages for our DNS which is bind and bind utils.
03:45 And I have provided all these instructions in the deck.
03:48 So you could use variable those.
6. Create the corp.internal Zone File
时间范围：03:59–05:03
总结 / Summary
中文
创建 corp.internal 区域文件（Zone File），用应用和数据库实例的私有 IP 填充 A 记录（A Records）。这与在 Route 53 私有托管区域（Private Hosted Zone）中创建名称到私有 IP 的记录作用相同，只是权威数据由自建 BIND 服务器保存。
English
A corp.internal zone file is created with A records for the application and database private IPs. It serves the same name-to-private-address purpose as records in a Route 53 Private Hosted Zone, but the authoritative data now lives on the self-managed BIND server.
Transcript
03:59 Okay, so now we need to create a few files to actually configure the DNS server and all the steps I've
04:05 just captured in the notepad so that I can copy and paste.
04:08 The first thing we need to do is to create a file with the name as the domain name.
04:13 So let me do that.
04:17 And there is content for this file here.
04:21 And you need to make sure that you are replacing the content wherever it is marked as x.
04:27 So most important is like you need to put the IP address of your app server.
04:32 So we are basically creating the A records like we used to do in the private hosted zone.
04:37 So let's grab the IP address for the app server which is 180 1010 zero 180.
04:43 And for DB server it's 1214.
04:46 So let's do that.
04:47 This is 180.
04:50 This is 180.
04:51 And this is sorry I forgot uh 214214.
04:59 That's it.
05:00 We are good.
05:01 Just save this file.
7. Configure named.conf and Start the DNS Service
时间范围：05:03–06:21
总结 / Summary
中文
修改 /etc/named.conf，设置允许查询/传送的 VPC 地址范围、递归与转发器，并声明 corp.internal 主区域及其文件。随后重启 named 服务，并启用开机自动启动（Service Enablement），完成自建 DNS 服务配置。
English
/etc/named.conf is updated with the allowed VPC address range, recursion and forwarding behavior, and a master-zone declaration for corp.internal. The named service is restarted and enabled at boot, completing the custom DNS server configuration.
Transcript
05:03 And now we need to also modify Iecee conndot file which actually configures the zone file ATC.
05:14 So we need to just remove everything in this file.
05:17 So I'm just removing everything and just adding the content here.
05:25 That's it.
05:26 And we need to make sure that we are adding the DNS server IP here.
05:30 So let's get the DNS server IP which is 179.
05:35 So 179.
05:37 Now if you are using different Cidr range, of course you need to change the entire IP address.
05:42 But I'm using the same as ten dot ten dot.
05:45 That's where I don't need to change those things okay.
05:48 Just save it.
05:49 That's it.
05:49 Those are the settings we need to just restart the named service.
05:53 So let's do that service named restart.
05:57 And we are good.
05:58 So so DNS server has been now set up.
06:02 Um now what we need to do next is to also configure the config so that if we reboot the server, uh,
06:09 your DNS uh service also comes up automatically.
06:13 So that's it.
06:14 We have done that.
06:15 So so far what we have done is just created everything and configure the DNS server.
8. Step 2a: Setup the DNS Server
时间范围：06:21–06:22
总结 / Summary
中文
步骤回顾要求登录 DNS 服务器（DNS Server），执行 yum update -y，并安装 bind 与 bind-utils。这张快速 Slide 对应前面的软件安装阶段。
English
The Step 2a recap logs in to the DNS server, runs yum update -y, and installs bind and bind-utils. This brief slide summarizes the package-installation stage.
Transcript
06:21 All the steps are given here.
9. Step 2c: Configure the DNS Server
时间范围：06:22–06:24
总结 / Summary
中文
配置回顾展示 /etc/named.conf 的关键项：允许来自 VPC CIDR 的请求/传送，设置转发器（Forwarders），并声明 corp.internal 主区域（Master Zone）和对应区域文件。
English
The Step 2c recap highlights the important /etc/named.conf settings: allow requests and transfers from the VPC CIDR, configure forwarders, and declare the corp.internal master zone and its zone file.
Transcript
06:22 You can just follow this okay.
10. Step 3: Create a DHCP Option Set
时间范围：06:24–06:51
总结 / Summary
中文
下一步创建 DHCP 选项集（DHCP Option Set）：域名设为 corp.internal，名称服务器设为自建 DNS 实例的私有 IP，然后把选项集关联到 VPC。为让现有实例立即获取新租约，实验会重启相关实例。
English
Step 3 creates a DHCP option set with domain corp.internal and the custom DNS instance's private IP as the name server, then associates it with the VPC. The lab restarts existing instances so they obtain the updated lease immediately.
Transcript
06:24 So now is the time when we tell VPC that uh you need to use different uh domain name.
06:31 And how do we do that is using the Dhcp options sets.
06:35 Right.
06:36 So in Dhcp option set we are going to create a new one called dot internal as a domain name and name
06:42 server.
06:42 This time we are going to use this DNS server as a name server.
06:46 So let's do that.
06:47 Let's go to the AWS console again.
11. Create and Associate the Custom DHCP Option Set
时间范围：06:51–07:58
总结 / Summary
中文
在控制台创建 corp.internal DHCP 选项集（DHCP Option Set），把 domain-name-servers 设置为 DNS 实例的 10.10.0.179，其余参数保留默认，然后替换 VPC 当前关联。此后客户端的新 DHCP 配置会把查询定向到自建服务器。
English
The console creates a corp.internal DHCP option set, sets domain-name-servers to the DNS instance at 10.10.0.179, leaves other settings at their defaults, and replaces the VPC association. New DHCP configuration now directs client queries to the custom server.
Transcript
06:51 Let's get the name server IP address 1010 zero 179.
06:56 Uh, let me go here and.
07:01 Let's go to the Dhcp options sets and create a new one.
07:05 Let's call it Carp dot internal and same as the domain name.
07:17 Dot Dhcp and domain name is ten dot ten .0.179.
07:29 That's it.
07:29 Rest of the settings.
07:30 You can leave as it is and we're just creating that.
07:33 Now.
07:34 Next thing we need to do is to use our VPC.
07:37 And in this VPC we need to make sure that it's using the correct Dhcp option set.
07:43 So we just go here and use our Dhcp option set okay.
07:48 So this has been done.
07:50 That means our machine should now redirect all the queries to the DNS server that we configured.
12. Refresh DHCP Configuration by Rebooting Instances
时间范围：07:58–09:11
总结 / Summary
中文
DHCP 选项集变更要等 DHCP 租约（DHCP Lease）续订才会自动生效。为了加快实验，应用、DNS（以及可选的数据库）实例执行软重启（Soft Reboot）；实例保留原有公有 IP，并在启动后获取新的搜索域与名称服务器配置。
English
A DHCP option-set change normally takes effect when the DHCP lease renews. To accelerate the lab, the application and DNS instances—and optionally the database instance—receive a soft reboot. They retain their existing public IPs and acquire the new search-domain and name-server settings after boot.
Transcript
07:58 But it takes time for this Dhcp lease to expire and refresh so that EC2 learns that.
08:04 Now configurations have changed the fastest ways to just reboot the server.
08:09 You don't need to stop and start, but just, uh, reboot it.
08:13 It's a soft restart, basically.
08:15 Uh, so you can do that from here as well if you want.
08:18 And I'm just doing that for the app server.
08:21 And similarly I'm doing that for the reboot it for the DNS server.
08:28 Now.
08:29 That's it.
08:29 Um, if you want, you can also reboot for the DB server.
08:35 It will take a couple of maybe seconds, for instance, to be up again, and I expect my connection
08:41 must have been broken by that time.
08:44 Okay, now, one interesting thing.
08:46 If you could see here, if you have this DNS server, uh, it has got this carved out internal as a
08:54 hostname.
08:54 Similarly for app server, it has got this hostname and there is no public IP DNS because for VPC we
09:02 did not have the uh DNS hostname flag enabled.
09:06 That's where you don't see it here.
09:07 But we can still connect with the public IP which it already had.
13. Verify Custom DNS Resolution
时间范围：09:11–10:52
总结 / Summary
中文
重新登录应用实例后，/etc/resolv.conf 显示搜索域为 corp.internal、名称服务器为 10.10.0.179，证明 DHCP 配置已生效。nslookup app.corp.internal 与 db.corp.internal 返回区域文件中的私有 IP，ping db 也因搜索后缀自动补全而成功。此时解析完全由自建 BIND DNS 服务器（Custom BIND DNS Server）提供，不再使用 Route 53 解析器（Route 53 Resolver）。
English
After reconnecting to the application instance, /etc/resolv.conf shows search domain corp.internal and name server 10.10.0.179, proving that DHCP applied the change. nslookup app.corp.internal and db.corp.internal return the private addresses from the zone file, and short-name ping db also works through the search suffix. Resolution now comes from the custom BIND server rather than the Route 53 Resolver.
Transcript
09:11 So let me just restart this session.
09:15 So I'm into the DNS server right now.
09:18 And similarly let me try to get the IP address of my app server and just log into that app server.
09:34 Okay, so I'm in the app server.
09:36 Now let's look at a few things.
09:38 Let's look at uh resolv.conf file first because it reflects what my, uh, search domain is.
09:46 So you can see automatically there is a called dot internal as a search domain.
09:49 And the name server is 1010 zero 179.
09:52 Now this is something which has been automatically, uh configured by the Dhcp option set.
09:59 And now let's try to do say Nslookup and app dot core dot internal.
10:07 And you can see it's resolving the IP address of itself.
10:10 At the same time we can do DB dot corp dot internal.
10:15 Because all these entries we had created in the uh DNS server configuration file.
10:21 And it resolves to this two and four IP.
10:23 That means whatever we had thought it's working fine.
10:26 We can also do something like this ping db and it goes to the db.com dot internal.
10:32 Because in our search domain it automatically adds this core dot internal.
10:37 So that means everything is working as expected.
10:40 Now in this case we are using custom Dhcp option sets with custom domain name server.
10:45 We are not using the route 53 DNS server.
10:48 So that's it.
10:49 About this lecture I wanted to just make sure we can do it.
14. Step 4: Verification Checklist
时间范围：10:52–11:02
总结 / Summary
中文
最终检查表是：登录应用服务器，查看 /etc/resolv.conf，确认 DNS 服务器与搜索域，解析应用和数据库的完全限定域名（FQDN），并用短名称 db 进行 ping。这些结果共同验证自建 DNS 链路端到端可用。
English
The final checklist logs in to the application server, inspects /etc/resolv.conf, confirms the DNS server and search domain, resolves the application and database FQDNs, and pings short name db. Together, these checks validate the custom DNS path end to end.
Transcript
10:52 And uh if you have time please try these things so that you understand everything end to end.
10:57 So thanks for watching this lecture.
10:59 That's it for this lecture.
11:00 Thank you.
整讲总结 / Overall Summary
中文
本实验完成了 VPC 自建 DNS（Custom DNS）的完整部署：BIND 服务器保存 corp.internal 区域和 A 记录，DHCP 选项集（DHCP Option Set）把所有客户端指向该服务器，重启或续租后 /etc/resolv.conf 自动更新，最终 FQDN 与短名称都能解析。关键网络要求是客户端可达 DNS 服务器，并允许 UDP 53。
English
This lab completes an end-to-end custom DNS deployment in a VPC. A BIND server hosts the corp.internal zone and A records, a DHCP option set directs every client to that server, and /etc/resolv.conf updates after reboot or lease renewal. Both FQDN and short-name lookups succeed, provided clients can reach the server on UDP port 53.