Lecture 220: Hands On: Route53 Resolvers - Part 3 - Resolver endpoints
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：09:50
- 来源：Udemy Lecture 33189978
- Slide 数量：7
- 画面切换：01:30、03:00、04:30、06:00、07:30、09:00
扫描说明
逐条读取了 Udemy 页面中的 153 条英文 Transcript cue，并按时间轴扫描全长约 09:50 的视频。依据 Inbound Security Group、双 AZ Inbound Endpoint、BIND Forward Zone、On-premises 验证与持久化、Outbound Endpoint、Forwarding Rule 与 Cloud 验证、Cleanup 划分为 7 个小节。首次批量截图因视频已到 Up-next 状态而定位失准，随后逐张以 Transcript cue 重新定位并复核；最终全部为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 先为 Inbound Resolver Endpoint 创建 UDP/53 Security Group
时间范围：00:00–01:30
总结 / Summary
中文
要让 On-premises DNS 查询 cloud.com，先在 Cloud VPC 创建 Inbound Resolver Security Group。Endpoint 本质上通过 VPC ENI/IP 接收 Query，因此 Inbound Rule 允许 DNS UDP Port 53，Source 限定为 On-premises CIDR 192.168.0.0/16。这样跨 VPN 的本地 Resolver 才能访问 Endpoint，同时不把 DNS 暴露给无关网络。
English
To let on-premises DNS resolve cloud.com, first create an inbound resolver security group in the cloud VPC. The endpoint receives queries through VPC ENIs and IPs, so allow DNS over UDP port 53 from on-premises CIDR 192.168.0.0/16. This permits the local resolver across the VPN without exposing DNS to unrelated networks.
Transcript
00:00 Okay.
00:00 So this is step three.
00:01 Now where we need to set up the rest of the things.
00:04 And that will be primarily around this route 53 resolver endpoints.
00:08 Right.
00:09 And here first thing we need to do is to make sure that on premises can resolve the cloud.com domain
00:15 name.
00:15 And for that we need this inbound end points on the AWS side of the VPC.
00:22 So for that we need to create this inbound end points as I said.
00:25 And these endpoints are Enis which means they also have the security group.
00:29 So we will allow the UDP traffic on port 53 from the on premises VPC cider network range.
00:36 So let's follow these steps and create these inbound endpoints.
00:41 So let's first create the security group and then let's create these endpoints.
00:45 Okay.
00:46 So let's go here on the left side in the EC2 console or in the VPC console as well.
00:51 You can go and create the security groups.
00:53 So let's create a security groups and let's call it route 53 Inbound Resolver SG.
01:01 Or you can also call this cloud site and the VPC should be the cloud one.
01:09 Let's add inbound rule and say udp DNS 53 from the 192.168.0.0 slash 16.
01:22 And that's it.
01:23 Let's create the security group.
01:25 Now let's go to the route 53 service.
01:27 And here let's go to the inbound endpoints.
2. Inbound Endpoint 跨两个 Private Subnet/AZ 部署并获得两个 IP
时间范围：01:30–03:00
总结 / Summary
中文
在正确 Region 创建 Inbound Resolver Endpoint，选择 Cloud VPC、刚建立的 Security Group、IPv4 和默认 Protocol。为高可用分别选择两个 AZ 的 Private Subnet，让 AWS 自动分配两个 Private IP。创建完成后记录这两个地址；On-premises BIND 将把 cloud.com Query 同时 Forward 到它们。
English
Create the inbound resolver endpoint in the correct Region using the cloud VPC, the new security group, IPv4, and the default protocol. Select private subnets in two Availability Zones and let AWS assign two private IPs for high availability. Record both addresses because the on-premises BIND server will forward cloud.com queries to them.
Transcript
01:31 And here make sure that you are in the right AWS region.
01:34 Let's create the inbound resolver endpoint.
01:37 Let's give it a name.
01:40 The VPC should be the cloud VPC.
01:42 The security group that we just created.
01:45 This one and endpoint type is just IPv4.
01:50 As of now we don't have IPv6 traffic and protocol.
01:54 Let's keep it as it is.
01:56 Now we need to create this in two different subnets and that will be in the private subnets.
02:01 So let's select this private subnet.
02:04 And we can also select another AZ and another private subnet.
02:10 Alright that is done.
02:12 Let's create this inbound resolver endpoint.
02:15 Okay.
02:16 Now endpoint has been created.
02:17 Next thing is we need to configure this IP addresses in the on premises side of the DNS server to forward
02:24 traffic for the Cloud.com to these IP addresses.
02:29 And here are those two IP addresses okay.
02:32 So we are done with this.
02:33 Now let's go here on the on premises DNS server.
02:37 And then add this zone for Cloud.com in the same named.conf file.
02:43 Now for this again you can refer to this text file here which is there as a part of your lecture.
02:49 So I'm just copying this and I need to replace these two IP addresses with the inbound resolver IP addresses.
02:56 Now just remember, one thing is that you should be on the DNS server many a times.
3. 在 BIND named.conf 中把 cloud.com 定义为 Forward-only Zone
时间范围：03:00–04:30
总结 / Summary
中文
登录真正的 On-premises DNS Server，在 /etc/named.conf 末尾加入 cloud.com Zone，Type 设置为 forward，Forward only，并把 forwarders 替换为 Inbound Endpoint 的两个地址 10.0.10.224 与 10.0.11.210。保存后重启 named.service 并确认 Active；此后 BIND 收到 cloud.com Query 会经 VPN 转给 Route 53 Resolver。
English
On the actual on-premises DNS server, add a cloud.com zone to /etc/named.conf with type forward, forward only, and the two inbound endpoint addresses 10.0.10.224 and 10.0.11.210 as forwarders. Restart named.service and confirm it is active. BIND will then send cloud.com queries through the VPN to Route 53 Resolver.
Transcript
03:00 There is a confusion and you might set this up in the wrong server, so make sure that you are there.
03:07 Okay so let's do sudo VI slash etc. name t dot conf.
03:16 Let's go towards the end and paste this content.
03:21 Now I need to replace this end points.
03:24 So it should be ten .0.10. something.
03:29 So it's a 10.2 24 and 11 dot 210.
03:34 So ten dot 224 and then ten .0.11. 210 and then remove rest of the things.
03:47 Right.
03:48 So that's done.
03:49 Let's save it.
03:52 And we need to restart the service.
03:54 So again let's do sudo systemctl restart nemty dot service, and you can also check the status.
04:08 Yeah it is running.
04:10 Okay so we are done with this.
04:12 Now next thing we need to check if we can resolve the cloud domain name from the on premises app server.
04:18 So again let's go to the app server and try to resolve app.cloud.com domain name.
04:24 And let's check this Nslookup app dot cloud.com.
4. On-prem App 先修复 resolv.conf，再成功解析并 Ping app.cloud.com
时间范围：04:30–06:00
总结 / Summary
中文
On-premises App 首次 nslookup 仍失败，因为 /etc/resolv.conf 被自动改回默认 192.168.0.2。重新把 Nameserver 指向 BIND 192.168.10.31 后，app.cloud.com 解析为 10.0.0.163，并能 Ping 通 Cloud App。要持久化，可修改 VPC DHCP Option Set，或在 Instance Network Config 中设置 DNS1=192.168.10.31，避免 Reboot 后丢失。
English
The first on-premises lookup fails because /etc/resolv.conf has reverted to default resolver 192.168.0.2. Point it back to BIND at 192.168.10.31; app.cloud.com then resolves to 10.0.0.163 and can be pinged. For persistence, modify the VPC DHCP option set or configure DNS1=192.168.10.31 in the instance network settings so a reboot does not discard the resolver.
Transcript
04:31 And this doesn't resolve which is not expected.
04:34 And it may happen right.
04:36 Because sometimes the DNS settings change automatically.
04:39 So for that you need to just check slash etc..
04:42 Resolv.conf.
04:44 And you can see it has been reverted back.
04:46 Now, in order to permanently set this, there are few additional things you might have to do, but
04:51 to save time, let's just modify this file again and configure it for the DNS server that is ten .31.
05:03 And let's try again.
05:05 And now it resolves to the app server on the cloud side.
05:09 Right.
05:09 And you can also do ping.
05:13 And it works right.
05:14 So that means from on premises to AWS cloud domain we are able to resolve the DNS queries.
05:19 Now as I said, in order to permanently set this name server, you can either change the DHCP option
05:26 set for the entire VPC, or you can do that at the EC2 instance level by modifying this file here.
05:33 So there is a file called Ifcfg for eth0.
05:39 And there at the end you can add DNS one equal to 192168.10.31.
05:47 And then this setting will persist basically.
05:51 Right.
05:51 So again we can resolve the DNS.
05:53 And that's what we wanted to do.
05:55 Okay, so we have won half the battle.
05:59 And again congratulations for this.
5. 为 AWS → On-premises 创建 Outbound SG 与双 AZ Endpoint
时间范围：06:00–07:30
总结 / Summary
中文
反方向要解析 onprem.com，因此在 Cloud VPC 创建 Outbound Resolver Security Group。Endpoint 不需要 Inbound Rule；Outbound Rule 只允许 DNS UDP/53 到 192.168.0.0/16（课程界面先移除宽泛的 All Traffic Rule）。随后创建 IPv4 Outbound Endpoint，关联该 SG，并同样在两个 Private Subnet/AZ 分配 ENI/IP。
English
For the reverse path to onprem.com, create an outbound resolver security group in the cloud VPC. The endpoint needs no inbound rule; restrict its outbound rule to DNS over UDP 53 toward 192.168.0.0/16, replacing the broad all-traffic default. Then create an IPv4 outbound endpoint using that group with ENIs in private subnets across two Availability Zones.
Transcript
06:02 Now the last part where from the cloud side we want to resolve app dot on prem com domain name.
06:09 Right.
06:09 And for that we need to set up the outbound resolver here.
06:13 And for that we again need to have the security group.
06:15 And then we will create the outbound resolver.
06:18 And then we will add a condition saying that if the domain name is on prem.com then the traffic should
06:24 go to the DNS server private IP address.
06:27 Right.
06:27 So let's do this.
06:29 Okay.
06:29 So let's go to the security groups again.
06:31 And let's create another security group.
06:37 And let's call it say cloud route 53 outbound resolver SG.
06:47 It has to be in the cloud VPC.
06:50 And we don't need inbound rules.
06:52 We just need outbound rules.
06:54 Generally, the default outbound rule is okay, but in order to make it a little specific, let's call
07:00 it 19216800 16.
07:03 And here again it should be DNS UDP traffic.
07:07 So let's create the outbound rule.
07:10 Next let's go to the route 53 outbound endpoints.
07:14 Let's create the endpoint with the name that we had created in the cloud VPC.
07:21 The security group for the outbound one endpoint type is IPv4 and protocol is the default one.
07:29 Now again it will be in the same private subnet.
6. Forwarding Rule 将 onprem.com 指向 192.168.10.31，Cloud 查询成功
时间范围：07:30–09:00
总结 / Summary
中文
创建 onprem Rule，Action 为 Forward，Domain 为 onprem.com，关联 Cloud VPC 与新 Outbound Endpoint，Target IP 指向 BIND Server 192.168.10.31。Rule 生效后，从 Cloud App Server 执行 nslookup app.onprem.com，正确得到 On-premises App Private IP，并可 Ping 通。至此 Inbound 与 Outbound 两个方向都完成。
English
Create an on-prem rule with action Forward for domain onprem.com, associate it with the cloud VPC and new outbound endpoint, and target BIND server 192.168.10.31. Once active, nslookup app.onprem.com from the cloud application resolves to the on-premises application's private IP and ping succeeds. Both inbound and outbound directions are now complete.
Transcript
07:33 So let's select both the subnets one by one.
07:37 And that's it.
07:39 Basically let's create the outbound endpoint.
07:43 Now once the endpoint has been created now here let's create the rule let's call it say on prem rule
07:53 and traffic is forward.
07:55 Domain name is on prem.com.
07:59 The VPC is cloud VPC.
08:01 That means it will only accept traffic from this VPC, and the endpoint is the one that is being created
08:06 and the target IP.
08:08 So we know that it is 192.168.1.31.
08:14 That's it.
08:15 Let's submit this and let's wait for this endpoint to be created.
08:20 Okay.
08:20 So we are done with all these settings.
08:23 And now if everything is okay then we should be able to resolve app dot on prem com to the private IP
08:29 address of that EC2 instance.
08:31 And we should be able to ping as well because we have the right security groups.
08:36 So let's try this.
08:37 Okay so I'm into the cloud side of the app server.
08:39 And you can very well see that from the IP address.
08:42 So let's do Nslookup app dot on prem.com.
08:46 And you see it is resolving the DNS.
08:49 Now That's the core exercise that we wanted to do.
08:52 And optionally you can also try to ping to on prem com and it works right.
08:58 And if it is working for you that's what we wanted to do.
7. 实验结束必须按依赖顺序 Cleanup，尤其 VPN 与 NAT 等计费资源
时间范围：09:00–09:50
总结 / Summary
中文
验证后不要遗留计费资源：Terminate 全部 EC2；删除 VPN Connection、VGW、CGW；删除 NAT Gateway；先删除 Resolver Rule 再删 Resolver Endpoint；删除 Route 53 A Record 后再删 Private Hosted Zone；最后删除两个 VPC。注意 Endpoint、VPN、NAT 与其依赖关系，先解除引用再删除能避免 Resource-in-use 错误。
English
After verification, remove billable resources: terminate all EC2 instances; delete the VPN connection, VGW, and CGW; delete the NAT gateway; remove resolver rules before resolver endpoints; delete the Route 53 A record before the private hosted zone; and finally delete both VPCs. Respect dependencies to avoid resource-in-use errors.
Transcript
09:02 So we could resolve the DNS from both the sides.
09:05 Right.
09:06 And if you could do this and probably troubleshoot some issues on the fly then congratulations.
09:12 You really did a great job.
09:14 So it's really time to celebrate.
09:17 But before you do that the most important thing do the cleanup.
09:21 The first thing, terminate all EC2 instances and then terminate the VPN connection because VPN connection
09:27 doesn't come in the free tier quota and also delete the route 53 hosted zone and everything that you
09:34 might have created in this setup.
09:35 Right?
09:36 So remember to do this cleanup and then you can probably celebrate a little.
09:41 Right.
09:42 So I hope you enjoyed this exercise.
09:44 And that's it really.
09:46 So thanks for watching and stay tuned.
09:49 Ay ay ay.
整讲总结 / Overall Summary
中文
Part 3 用 Route 53 Inbound Endpoint 让 On-premises BIND 把 cloud.com 转入 AWS Private Hosted Zone，再用 Outbound Endpoint + Forwarding Rule 把 AWS 的 onprem.com Query 送到 192.168.10.31。两类 Endpoint 都跨两个 AZ，并用最小范围 UDP/53 Security Group。双向 nslookup/ping 成功后，按依赖顺序清理全部实验资源。
English
Part 3 uses a Route 53 inbound endpoint so on-premises BIND can forward cloud.com into the AWS private hosted zone, then uses an outbound endpoint and forwarding rule to send onprem.com queries from AWS to 192.168.10.31. Both endpoints span two Availability Zones and use narrowly scoped UDP 53 security groups. After bidirectional lookup and ping succeed, clean up all lab resources in dependency order.
返回顶部 ↑