网络课程笔记

00:00 Hi.

00:01 Now, this is one of the most interesting exercises in this entire course because in this exercise we

00:07 are going to set up a lot of things.

00:08 And that's where this exercise is divided into three parts.

00:12 And I encourage you to do this exercise on your own because if you could do it, I sincerely think that

00:19 you understand how AWS networking works.

00:22 Okay.

00:23 So in this exercise we want to try and set up the hybrid DNS.

00:28 Now when we say hybrid, which means DNS can be resolved on AWS side or DNS can also be resolved on

00:36 the on premises side.

00:37 So in this exercise we are going to do both.

00:41 So our lab architecture will look something like this.

00:45 Now I know that this looks a little complex but let's try to simplify that.

00:50 So on the left side we will have the cloud DNS with the name Cloud.com.

00:54 And on the right side we have on prem.com as a domain name.

00:58 Now what we want to achieve that if any query for the domain name cloud.com or the subdomains.

01:04 For example, app dot cloud.com should go to AWS route 53 private hosted zone.

01:10 And if there are any DNS queries for on prem.com domain name, then all should be routed to this DNS

01:17 server which is hosted in the simulated on premise network.

01:21 And how do we do that?

01:23 Now for that let's first start with the left side.

01:26 So here as you can see we just have a VPC and a simple server which we will use to test our DNS query

01:34 resolution.

01:35 Now in here because AWS has route 53 private hosted zone, we can just create a private hosted zone

01:41 with the name as Cloud.com.

01:44 And then of course, you know that this app server, EC2 instance or any other instances in the VPC

01:50 on the left side can directly query the DNS using the route 53 local resolver.

01:56 Right, so this will work.

01:58 But what about if the query is coming from the on premises network.

02:02 Now for that, the first thing we need to have the site to site VPN connection or the direct connect

02:08 connection between this VPC and the on premises network.

02:11 So we will have this site to site VPN connection.

02:15 And this VPN server here will act as a router to send all the traffic for AWS through this VPN tunnels.

02:23 Right.

02:24 So that's the first thing.

02:25 Second, this app servers on the on premises site, which are nothing but any normal application, basically

02:33 will send the DNS queries to the DNS server, which is there in the on premises site.

02:39 So now if you want to send all the DNS queries for the Cloud.com to this private hosted zone, the thing

02:45 that we need on the AWS side, as we learned in the previous lectures, is the route 53 resolvers,

02:51 and it will be inbound resolvers.

02:53 So on the AWS side, we will create inbound resolvers.

02:57 And then on the on premises side, we need to tell this DNS server that if you receive any DNS queries

03:04 for the cloud.com domain, then forward it to this IP addresses of this inbound resolvers.

03:09 Right.

03:10 So any application server there on the on premises, if it wants to hit app dot Cloud.com that DNS query

03:17 will be first sent to the DNS server.

03:19 And from there it will go to the inbound resolver endpoint.

03:22 And from there it will go to the private hosted zone.

03:25 So that's where all the servers will resolve the cloud.com domain name Rthy.

03:32 Right.

03:32 So I hope it is clear.

03:35 Now the second part, how can you set up and resolve the DNS queries for the on premises?

03:40 Com.

03:41 Now for that very first thing we need to have a DNS server on the on premises site.

03:45 So we will set that up and we will configure it with a domain name as on prem.com.

03:52 Now again if the DNS query is coming from the local application server on the right side, then the

03:57 DNS query will be resolved from there itself, right?

04:01 But if the DNS query is coming from the AWS side of the network, then we need the route 53 outbound

04:09 resolver endpoints.

04:10 Right.

04:11 So for that we will create the outbound resolver endpoints.

04:14 And in that we will have a conditional forwarder which says if the DNS query is for on prem dccom then

04:21 send it to this DNS server which is hosted on the on premises network.

04:26 Then all this traffic will again go through this VPN connection and will hit the DNS server.

04:31 And that's how on prem Dccom will be resolved.

04:35 Right.

04:36 So that's our entire setup.

04:37 And that's our goal to achieve bidirectional DNS resolution.

04:42 And we are going to now implement this.

04:44 Now at this point I assume that you already know how to create VPCs and subnets and Nat gateways.

04:51 So in order to save some time I have just pre-created some part of this setup.

04:57 So for the AWS side of the network I have VPC with Cidr range 20.0.0.0, slash 16 and then public subnet

05:04 and the private subnets as shown.

05:07 So I hope you can also do the same.

05:09 Similarly on the right side of the network I do have similar VPC with 192 Cidr range.

05:15 And then I have a public subnet.

05:17 And in that I have also created a Nat gateway.

05:20 And then I have modified the route table of both the private subnets to send the traffic for the internet

05:27 through the Nat gateway.

05:28 And this Nat gateway is required because in this one of the subnets, we want to create a VPN server.

05:35 And we need to download some packages from the internet.

05:38 And that's where we need this outbound internet connection.

05:41 Right.

05:42 So I have already set this up.

05:44 So let me just show you quickly in the AWS console.

05:46 And then we will proceed with the next steps.

05:49 Right.

05:49 So as you can see I have this on premises VPC and the cloud VPC with the respective Cidr ranges.

05:55 Then I have the subnets.

05:56 Nothing fancy about that.

05:58 And then I have the route tables.

05:59 Again, these are very normal route tables that we have been creating and using all the time, right.

06:05 As I said in the private route table for the on premises VPC, I have the Nat gateway entries, so just

06:11 don't forget about that okay.

06:14 Now with that setup let's go to the next step.

06:17 And in here let's launch these two app server on both the side.

06:21 And these are very simple server.

06:22 We don't need to install any software on that.

06:25 They are there just to test the connectivity and the DNS resolution.

06:30 So on the AWS side we will launch that in a public subnet.

06:34 And on the on premises side we will launch that in the private subnet.

06:38 And further if you look at the security groups.

06:40 So I want to allow SSH because I can connect to that machine.

06:43 And also I'm enabling ICMP that is a ping from the on premises network.

06:48 So let's do that okay.

06:50 So I am into my Mumbai region.

06:52 So let me launch the instance and let's call it say cloud.

06:58 Make sure that you give right name so that you can identify your instances.

07:02 So Cloud App Server and Amazon Linux 23 Ami that is okay.

07:07 The key pair that I have and the networking make sure that you select the cloud VPC and the public subnet.

07:16 So let's select that.

07:17 And let's also have the public IP so that we can connect to that.

07:22 Now for the security group let's create a new security group so that we can have the specific rules

07:28 for this instance.

07:30 And in there I want SSH.

07:32 And then additionally I want ICMP that is ping.

07:36 And I want to allow that from 192.168 range to test the connectivity.

07:44 That's it.

07:44 And let's launch the instance okay.

07:47 That's done.

07:48 Now let's also launch the on premises side of the app server.

07:53 And in here we just need to again create similar instance.

07:57 But at this time we need to allow the SSH from this particular subnet or this particular VPC, Cidr,

08:04 because then we can connect and try the connectivity.

08:07 And again ICMP from the AWS side of the network.

08:11 So let's do that.

08:13 Okay going back to the instances and say launch the instance and let's call it on prem app server.

08:22 Again make sure that you use Amazon 2023 Ami.

08:26 Then select the key pair.

08:28 And on the networking side make sure you select the on premises VPC and the private subnet so you can

08:35 launch it in private subnet two.

08:38 Then we don't need a public IP.

08:40 And then we need to create a security group for this as well.

08:44 So let's use similar name now ssh I want to allow from either anywhere or you can be specific with 192

08:53 Cidr.

08:54 So let's do that.

08:56 And additionally let's allow ICMP, IPv4 and the range should be ten .0.0 so that AWS network can ping

09:06 to this instance.

09:07 Okay.

09:07 That's done.

09:08 Let's launch the instance.

09:12 Right now both the instances are launched.

09:14 And now the most important thing is to set up the site to site VPN.

09:18 Without that, you cannot really access this private instances across these two networks right now.

09:25 How to set VPN.

09:26 We have already done that exercise in the site to site VPN section, and if you remember, you can do

09:32 it on your own.

09:33 But if not, let's follow the steps here and let's quickly set up this VPN connection and then test

09:39 it.

09:40 Now, one thing about the VPN is that it really depends on the underlying operating system and then

09:45 which VPN software you are using.

09:47 So as of today, I am using Amazon Linux 23 as an Ami for this VPN server, and I am using Libreswan

09:53 as a VPN server.

09:55 Now, in your case, if you are watching this video in say, 2025.

09:59 Maybe there is a new army and these settings might not work, so please try to adhere to the same settings.

10:05 Right.

10:06 So now let's quickly set up the VPN connection.

10:08 And for that first thing we need is this VPN server.

10:11 And for this VPN server we will have the security group with the SSH open from anywhere.

10:16 So that I can connect to that and configure the VPN server.

10:20 And further, as you know, this VPN server will also act as a router to send traffic or receive traffic

10:25 from these instances, which are in a private subnet.

10:28 And that's where in order to send the DNS queries to the cloud or send the ping request to the cloud,

10:35 we will allow ICMP, IPv4 and UDP traffic on port 53 from this subnets or say entire VPC Cidr range.

10:45 Right?

10:45 So now let's create this VPN server and configure that okay.

10:51 Now back to the EC2 console.

10:52 And we should already have two servers.

10:55 Now this is our third server.

10:56 And let's call it say on prem VPN server and make sure that you use Amazon Linux 2023 Ami and the key

11:07 pair.

11:07 Whatever you have in the network, we should have it in the on premises VPC, and it should be in the

11:14 public subnet so that this VPN server can communicate with AWS side of the Virtual Private gateway.

11:21 Now we need a public IP, and then we need to create a security group for this VPN server.

11:28 As we learned.

11:29 And in there I'm allowing SSH.

11:31 And on top of that we need to have the DNS traffic.

11:36 So DNS UDP.

11:39 And this should be from 192 168 range.

11:43 And also we are going to add ICMP traffic from the same range.

11:54 Right okay.

11:55 So everything is done.

11:57 Now let's launch the instance.

12:02 Okay.

12:02 So we should now have three instances.

12:04 And in order to set up the VPN connection we need the public IP of this VPN server which is this.

12:13 Right.

12:14 So we created just the VPN server.

12:17 But we need to actually set up the VPN connection.

12:19 And for that on the AWS side we need to create this virtual private gateway.

12:23 We need to create the customer gateway with the public IP of this VPN server.

12:27 And then we need to create a site to site VPN connection.

12:32 So let's do that okay.

12:33 So for that let's go to the VPC console again.

12:36 And on the left side if you just go down here the first thing we need to create a virtual private gateway.

12:42 So let's call it cloud VW and rest of the settings as it is.

12:51 So this is our VW.

12:53 And then we need to attach that to the VPC.

12:56 So it won't allow us until it is fully created, but by that time, let's also create the customer gateway,

13:03 which is the other side of the VPN network.

13:05 So let's create the customer gateway and let's call it on prem.

13:10 GW and the IP address should be the public IP of the VPN server.

13:17 Right.

13:18 That's it.

13:18 Let's create this customer gateway.

13:21 And let's go back here and see if it is created.

13:24 Yes.

13:25 And we need to attach that to our VPC.

13:28 So let's select the cloud VPC and attach it right.

13:32 So once it is attached then we can create the VPN connection basically between the virtual private gateway

13:38 and the customer gateway.

13:40 So let's go here and let's create a VPN connection.

13:43 And let's call it cloud on prem VPN connection.

13:50 Now from AWS side we need to have the virtual private gateway.

13:55 And on the customer gateway side we already have it.

13:58 Now routing is static.

14:00 We are not using BGP and here we need to.

14:02 Provide the Cidr range from the on premises network.

14:07 So let's use this range.

14:11 And rest of the settings we can leave as it is.

14:13 And let's create this VPN connection.

14:17 Aethes okay.

14:18 Now again it will take maybe few minutes for this VPN connection to.

14:21 Be up and running.

14:22 And by that time we can set up our on premises VPN server.

14:26 So let's select this and download the VPN configurations.

14:30 Now here the vendor will be open Swan right.

14:35 So let's just download this and I'm just saving it somewhere.

14:38 Maybe on the desktop.

14:40 Let's save it now.

14:42 Next thing we need to open this configuration file.

14:44 And we need to use those settings to configure on premises side of the VPN server okay.

14:51 So I opened this file which is a simple text file.

14:54 And then we need to follow all these steps and few additional steps to set up the VPN connection, and

15:00 all the settings needs to be done on the on premises side of the VPN server.

15:04 So in order to do that, let's log in over SSH to the on premises VPN server and configure this settings.

15:12 Arthur.

15:14 Right.

15:14 Okay.

15:15 So let's go to the EC2 and pick this public IP again.

15:18 And I'm just opening my putty session.

15:22 And I will just put this IP address and I will load my SSH keys.

15:30 Which is this one.

15:34 And I can optionally also save this session so that I don't have to load my key again and again.

15:39 And with respect to the color, I want to have the white background and let me sorry.

15:46 Let me save this session say AWS with Chethan key.

15:55 Right.

15:55 And I can load this session.

15:59 The user will be EC2 dash user.

16:03 Right.

16:03 That's done.

16:04 Now we need to install the VPN software.

16:06 Right now, all the commands for setting up the VPN server are there in the slides.

16:10 And as I said, please try to adhere to the same VPN server settings, right?

16:16 Okay, so let's install the Libreswan as a VPN software.

16:20 And then we will additionally do some settings by referring to the text file that we downloaded.

16:27 Okay.

16:28 So let's do sudo yum install liberation.

16:36 And just press y and then it will install the Libreswan VPN server.

16:41 Okay that's done.

16:43 Now next thing we need to refer to our text downloaded file okay.

16:49 So it says that we need to add these entries into slash etc. Sysctl dot conf file.

16:55 So let's do that.

16:57 So let's do sudo.

16:58 That is for the root permission VI, etc..

17:01 Sysctl.

17:03 Conf and just go to the end and paste this lines.

17:11 Let's save it.

17:12 And then we have to do sudo sysctl minus p to apply these changes.

17:20 Sorry.

17:24 Right.

17:24 So that's done.

17:26 Next we want to make sure that this line is not hashed out in this etc. IPsec dot conf file.

17:33 So let's verify that.

17:34 So I'm just copying this and let's do cat right click.

17:40 And you can see here this line is not hashed out.

17:42 So this is what we want right.

17:45 Next we need to create this file which has all the VPN configurations.

17:49 So let's copy this first and create the file and then paste this contents there.

17:55 Okay.

17:55 So let's again do sudo VI this file and now I'll paste the content.

18:02 Okay so I pasted the content.

18:04 Now a few things you need to change here.

18:06 Right.

18:06 Very first thing the left subnet that is the left side of the network.

18:10 And that is our on premises network because we are doing these settings on the on premise server.

18:15 The left is itself right.

18:16 So let's configure that.

18:18 And the right side is the AWS side of the network.

18:22 So that is ten 000 slash 16.

18:26 Now other settings we need to remove this auth equal to ESP.

18:30 And then for the algorithms we need to change this alias 128 to 256 and mod 102 4 to 2 048.

18:46 Right.

18:47 And we need to do the same here.

18:49 So 256 and here it should be 2048 Right.

18:58 If we do these settings, I think we are good.

19:01 Further, we need to just create this secrets file and then we need to add the line which is there.

19:09 So let's do that.

19:13 Okay.

19:13 So let's do sudo VI this secrets file.

19:19 Press I for the insert mode.

19:20 Right click and escape colon wq.

19:24 Right.

19:25 So it has been saved.

19:27 Okay so the VPN configurations are done.

19:29 The last thing we need to do is to just start the VPN service.

19:33 And for that let's do sudo systemctl start IPsec dot service.

19:41 Okay.

19:41 It has been started.

19:42 And just to check the status let's do this.

19:47 And if you see this kind of message that means your VPN server is running fine.

19:53 And in order to verify that let's go to the AWS side of the VPN tunnels and lets see if one of the tunnel

19:59 is up.

20:00 Okay, so lets go to the VPC again and inside to site VPN connection.

20:04 Lets select this and lets go to the tunnel details.

20:07 So right now it's down, but lets wait for a couple of minutes.

20:13 So I'm pausing this video and I'll come back here okay.

20:16 Generally it takes up to 30s for this status to turn up here okay.

20:22 So which means our VPN is working.

20:24 And now let's proceed with additional settings with respect to the VPN routes so that we can test the

20:29 connectivity between the on premises side and the AWS side.

20:34 Ether.

20:35 Right.

20:35 So we have done everything which is listed on this slide.

20:39 And now let's configure the routes.

20:41 So on the AWS side we need to tell all these subnets that if the traffic is going to or coming from

20:46 the on premises network, then all the traffic should be routed through the virtual private gateway.

20:52 Now how do we do that.

20:53 So either you can add the static routes into the route table itself, or you can also propagate the

21:00 Cidr range automatically into this route tables.

21:03 So let's do that.

21:05 Right.

21:06 So if you come to the VPCs and go to the route tables, there are two route tables for the cloud and

21:11 two route tables for the on premises network.

21:13 So if you go to say cloud route table here then you will see there is only route for the local Cidr

21:20 range.

21:20 Right.

21:21 And here we need to add a route for virtual Private gateway.

21:24 Now as I said one option is to just add a static entry for the destination as the on premises Cidr range.

21:31 But the better way is to propagate that route automatically.

21:34 So for that let's go here edit the route propagation and enable this.

21:39 Now what it does is it automatically brings this particular Cidr range here in the route table.

21:47 Right.

21:47 So that's something that you need to do.

21:49 Second we will do the same thing for other route table on the cloud side.

21:54 And here also let's go to the route root propagation and enable that right.

22:00 And you can see that this entry has been added automatically.

22:04 So remember this step.

22:06 Okay.

22:07 So cloud side of the VPN configuration has been done.

22:10 Now let's go on the on premises side.

22:14 And in here we need to do few settings.

22:17 First we need to disable the source destination check on the VPN server.

22:21 And that is because it is going to forward all the traffic ultimately to this server.

22:27 So which means that traffic is not for this VPN server.

22:29 And we learned that earlier in the EC2 section as well.

22:32 So we will disable that.

22:34 And second, we will update the route table for the private subnets to send or receive traffic through

22:40 this VPN server.

22:42 Right.

22:42 So let's do that okay.

22:45 So let's go here.

22:46 Let's select the on premises VPN server action networking and change the source destination check.

22:53 And let's say stop Right.

22:57 And second, let's go to the private subnet for the on premises site which is this one.

23:05 Then let's go to the routes, then edit the routes.

23:08 And let's say if the traffic is going to or coming from ten 000 slash 16, then it has to go through

23:20 this Eni of the VPN server.

23:22 So instance and the VPN server.

23:27 Right.

23:27 So at this point we are done with the entire VPN setup.

23:30 So from the cloud EC2 instance we should be able to ping to the on premises EC2 instance using its private

23:36 IP and the other way round.

23:38 Right.

23:38 So for that we need to log in to one of the server.

23:41 So let's go to the cloud App server and we can just log in with the public IP.

23:47 So let's do that.

23:49 And here what I can do is just I can load my this session and just change the IP address so that I don't

23:56 have to load the keys again and again.

23:59 Right.

24:00 So EC2 dash user.

24:01 And now let's ping to the on premises servers private IP address which was 192.168.1. something.

24:11 So let's see that that is 157.

24:18 Right.

24:19 And you can see that I can ping.

24:21 That means our VPN connection is working perfectly.

24:27 Okay.

24:28 So we need to test this connectivity.

24:30 So we tested the first one that is from the cloud to the app server on the on premises side.

24:34 Now we need to do the other way around as well.

24:37 Now for that we need to log in to the app server.

24:39 And it's in a private subnet.

24:41 So first we log in to the VPN server.

24:43 From there we can SSH into the app server on the on premises side.

24:48 And from there we can try to ping to the cloud EC2 instance using its private IP.

24:53 And further from the app server we can also test the internet connectivity because that traffic will

24:58 go through the Nat gateway.

25:00 Right.

25:01 So what do I mean?

25:02 So from this app server we need to first test connectivity to the app server in the cloud.

25:06 And then from app server to the internet through this Nat gateway.

25:10 Right.

25:11 So let's do that.

25:11 And for that I need to first log in over SSH to this VPN server.

25:16 Then I need to bring in the SSH key which is a private key.

25:19 And then using that private key I will ssh into this particular instance.

25:24 Right.

25:25 So let's do that okay.

25:28 So I am already onto the VPN server.

25:30 So let me do VI.

25:31 And I need to create the PEM file for the app server.

25:35 And I'll copy the content here okay.

25:38 So this is my ssh pem file.

25:40 I'm copying it and I'm just pasting it here escape colon wq.

25:45 Then I need to change the permission to 400.

25:49 And then I need to ssh using this pem file ec2 dash user at the rate 192.168.1. I think 157.

26:02 Yes.

26:03 Okay, so I am into the app server and from there we need to ping to the cloud server.

26:07 So let's check what's the IP address of the cloud server.

26:11 So for that let's go here.

26:13 So cloud app server IP address is 163.

26:22 Right.

26:23 And I'm able to ping which means the connectivity from both the side is working fine.

26:28 Finally let's try to just ping say google.com.

26:33 And it is also working.

26:34 That means traffic is going to the internet.

26:38 Okay.

26:38 So this means we have completed our setup for the VPN.

26:42 So let's stop here for this particular lab.

26:44 So that was our first step basically.

26:46 And now let's move to the second step where we are going to configure now the DNS on both the sides

26:52 right.

26:53 So now let's go to the second step.

26:55 Thank you.