Lecture 219: Hands On: Route53 Resolvers - Part 2 - DNS configuration
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：10:53
- 来源：Udemy Lecture 33189972
- Slide 数量：7
- 画面切换：01:30、03:00、04:30、06:00、07:30、09:00
扫描说明
逐条读取了 Udemy 页面中的 173 条英文 Transcript cue，并按时间轴扫描全长约 10:53 的视频。依据 Cloud Private Hosted Zone、Cloud Local Resolution、On-prem DNS EC2、跳板 SSH 与 BIND、Zone File、named.conf + Service、resolv.conf 与 Local Resolution 划分为 7 个小节。截图均在 Transcript 侧栏关闭后复核；一个定位失准的 Zone File 画面用同一配置阶段的干净 named.conf 画面替换，最终全部为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 创建 cloud.com Private Hosted Zone 与 app A Record
时间范围：00:00–01:30
总结 / Summary
中文
在 Route 53 创建 Private Hosted Zone cloud.com，关联 Mumbai Region 的 Cloud VPC。随后建立 app.cloud.com A Record，Value 指向 Cloud App Server Private IP 10.0.0.163。VPC 的 DNS Resolution 与 DNS Hostnames 两项设置都要启用，EC2 才能通过 VPC Local Resolver 使用关联的 Private Hosted Zone。
English
Create a Route 53 private hosted zone named cloud.com and associate it with the cloud VPC in the Mumbai Region. Add an A record for app.cloud.com pointing to the cloud application server's private IP, 10.0.0.163. Enable both DNS resolution and DNS hostnames in the VPC so EC2 instances can use the associated private hosted zone through the local resolver.
Transcript
00:00 Okay.
00:01 Now this is step two where we will configure the domain names on both the sides of the network.
00:06 And for that we need to first start with the AWS site where we'll create the private hosted zone with
00:12 the name Cloud.com.
00:13 And there we will create the A record with the IP address of the app server.
00:17 And then we will test the DNS resolution from the cloud side itself.
00:22 Right.
00:22 So let's do this okay.
00:24 So for that we need to go to the route 53 and create a hosted zone with the name say Cloud.com.
00:31 It's a private hosted zone.
00:32 And that's where it has to be attached to our VPC on the cloud side.
00:37 So it's in Mumbai region and it has to be attached to the cloud VPC.
00:42 And let's create the hosted zone.
00:45 Now next thing we need to create a record of the type A with the name say app dot cloud.com.
00:51 And it should be the private IP address of the app server itself, which is 163.
00:58 So let's add that and create the record.
01:02 Okay.
01:02 So this record has been created here.
01:04 Now one more thing that you need to remember is that for resolving the DNS through route 53 local DNS,
01:11 we need to enable the DNS resolution for the VPC.
01:14 So for that let's go to the VPC settings action edit VPC settings and enable this both the settings.
01:23 Then only the DNS resolution happens with private hosted zone.
01:27 So let's do that.
2. Cloud App 本地 nslookup 成功后，再构建 On-premises DNS
时间范围：01:30–03:00
总结 / Summary
中文
在 Cloud App Server 上执行 nslookup app.cloud.com，等待设置传播后成功返回 10.0.0.163；若 Resolver 设置尚未生效，可等待或 sudo reboot 让 Instance 获取新 DNS 状态。这只验证 Cloud VPC 内部解析。下一步是在模拟 On-premises Network 部署独立 DNS Server，管理 onprem.com。
English
Run nslookup app.cloud.com on the cloud application server. After the VPC settings propagate, it resolves to 10.0.0.163; if the resolver change is not yet effective, wait or reboot the instance. This validates only cloud-local DNS. The next task is deploying a separate DNS server in the simulated on-premises network for onprem.com.
Transcript
01:30 Right.
01:30 So that is done.
01:31 Now let's go back to the cloud app server and try to resolve this DNS.
01:37 Okay so I was already logged in there.
01:40 So let me try Nslookup then app.cloud.com.
01:45 So it takes some time.
01:47 So let me wait for maybe a couple of minutes and then I will come back here.
01:51 Okay so I waited for a couple of minutes.
01:53 And in your case if it is not resolving you can also reboot the EC2 instance so that new DNS settings
01:59 change into the effect.
02:00 Right.
02:00 And you can do that using sudo reboot command.
02:03 Right.
02:04 So let's do nslookup and then app.cloud.com.
02:09 And you can see that it is resolving this to IP address.
02:13 So which means cloud side of the DNS is working fine.
02:16 But this is just on the cloud side.
02:18 We actually want to do that from the on premises side.
02:21 Now for that first we need to set up on premises side of the DNS server and view additional configurations.
02:27 So now let's do that.
02:29 Okay so we just completed this step.
02:32 And now let's do the other part.
02:34 And here we will launch this DNS server again on the EC2 instance.
02:38 And then we will configure it.
02:40 Now here as you know we need to open the security group for SSH so that we can configure and then DNS
02:47 traffic all the way from cloud side and also from this particular subnet or the entire VPC Cidr.
02:54 Right.
02:54 So again let's launch this instance and then let's configure it.
02:58 So for that we need to install the bind and bind utils which configures it as a DNS server.
3. 在 On-premises Private Subnet 启动 DNS Server EC2
时间范围：03:00–04:30
总结 / Summary
中文
启动 On-premises DNS Server，使用 Amazon Linux 2023，放入 On-premises VPC 的 Private Subnet，不分配 Public IP。Security Group 允许 SSH，并分别允许来自 On-premises 192.168.0.0/16 与 Cloud 10.0.0.0/16 的 UDP/53，因为稍后本地 App 与跨 VPN 的 Cloud Client 都要向它查询。
English
Launch an Amazon Linux 2023 on-premises DNS server in a private subnet of the on-premises VPC without a public IP. Allow SSH and permit UDP 53 from both on-premises CIDR 192.168.0.0/16 and cloud CIDR 10.0.0.0/16, since local applications and later cloud clients across the VPN must query it.
Transcript
03:04 So we will do that.
03:05 And then we need to create some additional configuration files okay.
03:10 So going back to the EC2 console.
03:12 So we have this three servers.
03:13 So let's launch one more and let's call it on prem DNS server and Amazon Linux 2023 Ami.
03:24 Then the key pair as it is.
03:28 And then we need to launch this in on premises VPC and in a different subnet that is a private subnet.
03:36 So for security group we need to allow the DNS traffic mainly.
03:41 So let's do that.
03:42 So SSH from anywhere.
03:44 That's okay.
03:45 And here let's say dns UDP from 192.168.
03:54 So that other application server in the same VPC can query to the DNS and additionally.
04:03 From the cloud side.
04:05 So for that ten .0.0.0 slash 16.
04:11 Right.
04:12 So that's done.
04:13 Let's launch the instance.
04:17 Okay.
04:18 So now we need to log in to this instance.
04:20 Now this instance is in a private subnet.
04:23 So we can't directly log in.
04:25 But we can SSH from the VPN server because VPN server is in a public subnet.
4. 经 VPN Server 跳板登录 Private DNS EC2，并安装 BIND
时间范围：04:30–06:00
总结 / Summary
中文
DNS Server 位于 Private Subnet，无法从 Internet 直接 SSH，因此先登录 Public VPN Server，再用已准备的 Private Key SSH 到 DNS Server 192.168.10.31。确认终端 IP 避免改错主机，执行 yum update，然后安装 bind 与 bind-utils，获得 named Authoritative/Recursive DNS Service 和 nslookup/dig 工具。
English
Because the DNS server is in a private subnet, first SSH to the public VPN server and then hop with the prepared private key to DNS server 192.168.10.31. Verify the terminal IP to avoid editing the wrong host, run yum update, and install bind plus bind-utils for the named DNS service and lookup tools.
Transcript
04:30 Right.
04:31 So let's take a private IP of this instance which is this.
04:35 And let's go to the SSH session of the VPN server.
04:39 And from there let's log in to the DNS server.
04:42 Right.
04:43 So I had this putty session already to log in to the app server.
04:46 So I can just duplicate this session which will get me into the VPN server first.
04:52 Right.
04:53 And you can verify that using the IP address range.
04:55 And from there I can use the same SSH key which I had created.
04:59 And now I will log in to the DNS server.
05:03 So the IP was 192.168, then dot ten something.
05:10 So that was 31.
05:11 Sorry I keep forgetting about these IP addresses.
05:15 Right.
05:16 So 31 let's say yes and then I'm into the DNS server.
05:21 Now next thing I need to install the DNS packages.
05:24 So first thing let's update the yum packages sudo yum update minus y.
05:31 So it will take some time to update the entire yum repository.
05:37 Okay, surprisingly there was nothing to update.
05:40 And now let's install the DNS packages.
05:43 So sudo yum install bind and then bind utils as well.
05:54 Yes.
05:57 Right.
05:58 So that's done.
05:59 So we did these steps.
5. 为 onprem.com 创建 BIND Zone File 与 app A Record
时间范围：06:00–07:30
总结 / Summary
中文
根据课程提供的文本模板，在 /var/named 创建 onprem.com.zone。Zone File 中保留 SOA/NS 等必要结构，并把 app.onprem.com 的 A Record 地址替换成 On-premises App Server Private IP 192.168.11.157。编辑时要注意格式、结尾点号与序列号等 BIND 语法，否则 named Service 会拒绝加载 Zone。
English
Using the supplied text template, create /var/named/onprem.com.zone. Preserve the required SOA and NS structure and replace the app.onprem.com A record with the on-premises application server's private IP, 192.168.11.157. BIND syntax, trailing dots, and zone details must be valid or named will refuse to load the zone.
Transcript
06:01 Next we need to create zone files for on prem dotcom.
06:05 And for that I have provided a text file because it is easy to copy from the text file.
06:10 So we need to create a zone file in this particular directory and paste this content and replace this
06:16 particular IP addresses with the IP address of our app server.
06:20 So let's do that.
06:23 And this is the text file that has been provided with this lecture.
06:26 So you can just copy it from here and replace the IP addresses as required.
06:31 So let's create this var named on prem.com dot zone file okay.
06:37 So again sudo viswa named on prem.com dot zone file insert.
06:49 And here we need to replace this IP addresses with the app server IP address which is 11 dot I think.
06:55 One 5711 dot 157 let's verify that once.
07:03 Yeah that's correct.
07:05 So here a few things.
07:07 You might see some text misalignment.
07:10 So if you want to correct that you can do that escape colon wq right.
07:16 So that's done.
07:19 Next we need to configure Etsy Named.conf and paste this content again here.
07:25 We need to replace this with the IP address of the DNS server itself.
07:29 So let's do this.
6. 在 named.conf 注册 Zone、设置 Listener/Forwarder，并启动 named
时间范围：07:30–09:00
总结 / Summary
中文
编辑 /etc/named.conf，让 named 在 DNS Server Private IP 192.168.10.31 上服务，允许需要的 Query/Transfer 范围，启用 Recursion，并注册 onprem.com Master Zone 指向 onprem.com.zone；配置中还把未权威回答交给 Forwarder。启动或重启 named.service 并检查 Active 状态。若失败，可用 named-checkconf 和 Zone 检查命令定位 Syntax Error。
English
Edit /etc/named.conf so named listens on private address 192.168.10.31, permits the required query and transfer scope, enables recursion, and registers onprem.com as a master zone backed by onprem.com.zone. The configuration also forwards non-authoritative lookups. Start or restart named.service and confirm it is active. Use named-checkconf and zone-checking tools if syntax prevents startup.
Transcript
07:31 So again I'm going back to the text file and just copying this content from here.
07:38 Now one thing to note is that because you have multiple putty session open, make sure that you are
07:43 in the right server and that you can verify using the IP address.
07:47 Right?
07:48 So let's do sudo VI slash, etc..
07:53 Named.conf.
07:56 Just delete everything so D and shift G deletes everything.
08:00 I for insert mode, right click.
08:02 Sorry.
08:03 Let me copy the content again.
08:07 And here make sure that you replace this with the IP address of the DNS server itself.
08:13 So it is dot ten.
08:15 And then something which is 31 because we are on the DNS server itself.
08:20 Right.
08:21 So that is done.
08:22 Let's save this file.
08:25 And now let's start the named service which is a DNS service basically.
08:29 So so for that we can use systemctl command.
08:34 So let's say sudo systemctl start or restart anything works name t dot service.
08:42 And if you don't see any error then that means service is probably started well.
08:48 And you can check that using the status command.
08:52 And it says that it is running and active, and it has also imported this zone file so it can resolve
08:59 the DNS for on prem.com.
7. 把 On-prem App 的 resolv.conf 指向 BIND，验证 app.onprem.com
时间范围：09:00–10:53
总结 / Summary
中文
在 On-premises App Server 上，尚未指定本地 DNS 时 app.onprem.com 无法解析。把 /etc/resolv.conf 的 nameserver 改为 192.168.10.31 后再次查询，名称正确解析到 App 自身 192.168.11.157。至此 cloud.com 在 Cloud 侧、onprem.com 在 On-premises 侧各自工作，但仍相互隔离；Part 3 将用 Resolver Endpoint 打通跨网络查询。
English
Before configuring local DNS, the on-premises application cannot resolve app.onprem.com. Set the nameserver in /etc/resolv.conf to 192.168.10.31 and repeat the lookup; the name resolves to the application's own address, 192.168.11.157. Cloud.com now works on the cloud side and onprem.com works on premises, but the namespaces remain isolated until Part 3 connects them with resolver endpoints.
Transcript
09:01 Now in some cases, if you miss some syntax in the zone file then this service will not start.
09:07 And for that you can use named dash check conf command.
09:10 And you can provide the path of the configuration files.
09:14 And it will tell you if the file is okay or not.
09:16 So if required you can do that okay.
09:20 So this is done.
09:21 Next thing we need to make sure that this app server sends all the DNS queries to this DNS server.
09:28 And for that on this app server we can say the name server is the DNS server private IP address.
09:35 And we can do that using the result dot conf file.
09:38 So let's do that okay.
09:41 So I am on to the app server.
09:42 And you can verify using the IP address.
09:45 And at this point if I do say ping app dot on prem com it won't resolve because it doesn't know right?
09:53 Until we update the name server.
09:54 So let's do sudo VI slash, etc. resolv.conf.
10:00 And in here the IP address should be the IP address of our DNS server, which is 10.31 I think.
10:08 So let's save it and let's try again.
10:13 And you see the DNS is being resolved to this private IP address which is itself.
10:18 But then it is happening.
10:19 Right.
10:20 So which means DNS is working fine on the on premises side as well.
10:25 Okay.
10:25 So which means we have configured the DNS but they are still isolated.
10:29 That means cloud DNS on the cloud side on premise DNS on the on premises side working fine.
10:34 And this is one of the milestone.
10:36 So congratulations.
10:37 Now that was step two.
10:39 And now in step three let's actually set up the hybrid DNS.
10:44 So we should be able to resolve the DNS from across both the networks right.
10:48 So let's stop here and let's go to the step three.
整讲总结 / Overall Summary
中文
Part 2 分别建立两套可独立工作的 Private DNS：Route 53 Private Hosted Zone cloud.com 关联 Cloud VPC，app.cloud.com 指向 10.0.0.163；On-premises Private EC2 安装 BIND，onprem.com Zone 中 app Record 指向 192.168.11.157。本地 Client 分别通过 VPC Resolver 与 resolv.conf 指向 BIND 完成解析，为下一讲跨 VPN Hybrid DNS 做准备。
English
Part 2 builds two independently functioning private DNS systems. A Route 53 private hosted zone cloud.com is associated with the cloud VPC and app.cloud.com points to 10.0.0.163. A private on-premises EC2 instance runs BIND for onprem.com, where the app record points to 192.168.11.157. Local clients resolve through the VPC resolver and BIND respectively, preparing for cross-VPN hybrid DNS in Part 3.
返回顶部 ↑