On a "normal" AWS Elastic IP it's possible to add a reverse DNS record (AWS Console > EC2 > Elastic IPs > IP > Actions > Update Reverse DNS).
On an IP address that comes via BYOIP and is otherwise working fine, rather than being part of the main AWS pool, this option is greyed out with no explanation of why.
Have also tried via the AWS CLI command aws ec2 modify-address-attribute which returns UnsupportedAddress error.
Is it possible to add a reverse IP address to a BYOIP and if so what is needed to do so as I can't see any limitation mentioned in the docs.
Related
I am trying to set up SSM on Windows.
I have an ASG in a private subnet (absolutely 0 internet access). I can not use NAT, only VPC endpoints.
In the instance launch configuration, I have a PowerShell script that uses Set-DnsClientServerAddress so that the instance can find and join an AWS Managed MS AD service. I would also like to set up the instance so it can be fully managed with SSM.
The problem comes with the DNS Client Server Address.
When I set it to match the address of the AD service SSM will not work.
When I leave the DNS Client Server Address default, SSM works but I can not join the AD.
I tried forcing the SSM Agent to use the endpoints by creating a amazon-ssm-agent.json file and setting all three endpoints in there. This allowed the instance to show on the Managed Instance list, but its status never changed from pending and requests from within the instance still timed out.
Does anyone know the magic sauce to get these things all working at the same time?
EDIT 1:
I also tried adding a forward as described in this thread, however I'm either missing somethign or it is not working for my case:
https://forums.aws.amazon.com/thread.jspa?messageID=919331󠜣
It turns out that adding the forwarder as described in the link above worked. The part I was missing was joedaws comment, "I would also remove the existing 169.254.169.253 entry so that only the 10.201.0.2 ip address is in the list".
Of course, my IPs are different, but once I removed the preexisting forward so that my x.x.x.2 IP was the only one in the list (I did this for both of the AD DNS servers) the instance was discoverable by SSM.
So, I would make a minor change to the list that saugy wrote:
On a domain joined windows instance, log in with AD domain Admin user
Open DNS manager
Connect to one of the DNS IP addresses for the AWS AD
Select forwarders
Add the VPC's DNS IP (x.x.x.2 from you VPC's CIDR range)
Remove the existing IP (so you VPCs IP is the only one)
Click Apply
Repeat from step 3 with the other DNS IP address for the AWS AD (not 1
Also, as mentioned in the other post. This only has to be done once and the settings persist in the AD DNS.
Anybody here has experience with configuration SMTP on Cpanel host by AWS EC2.
After I have done configurations, DKIM is valid, SPF is valid, but PTR is not valid (reverse DNS). Then when I sent a test email to mail-tester.com, it was 3/10. Here is the error message
We didn't find a server (A Record) behind your hostname ip-172-31-1-135.ap-southeast-1.compute.internal.
You may want to publish a DNS record (A type) for the hostname
ip-172-31-1-135.ap-southeast-1.compute.internal or use a different hostname in your mail software.
I'm a newbie for DNS stuff, if you need more information, please give me a comment.
You should configure your mail server software to use your custom hostname (for example mail.example.com), not the AWS assigned default (such as ip-172-31-1-135.ap-southeast-1.compute.internal)
You need to contact AWS support to have PTR record configured https://aws.amazon.com/blogs/aws/reverse-dns-for-ec2s-elastic-ip-addresses/
Keep in mind that Amazon EC2 throttles traffic on port 25 of all EC2 instances by default, but you can request for this throttle to be removed: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-port-25-throttle/
If you want to receive emails on this server you can't change port number from 25 to something else as other servers will try to connect on this port to deliver emails. You also have to ask AWS to remove throttle on port 25 as stated before.
If you haven't already, create A DNS record for cpanel.mydomain.com pointing to your elastic IP (it is important that you have elastic IP not automatically assigned public IP)
Finally, I got 9.8/10 after tweaking some configuration and waiting for AWS Support to map Elastic IP to my domain name, then I can get 10/10
Most importantly, have to make sure hostname has to your my domain
1. set hostname
sudo hostname cpanel.mydomain.com
Set it automatically
cd /etc/dhcp/dhclient-exit-hooks.d/
sudo nano set-hostname.sh
file set-hostname.sh
#!/bin/sh
hostname cpanel.mydomain.com
/scripts/fixetchosts
For more detail, please free to reference here
I have Windows EC2 instance I use for my public-facing C# API. The VPC(and related Internet Gateway, subnets, etc) are all default.
I've now setup an AWS ElasticSearch service using their more secure VPC Endpoint option (instead of public-facing) and I've associated it to the same subnet and vpc as my above Windows EC2 instance.
I'd like to get them to talk to each other.
Reading from https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html
It seems what you'd do is ssh tunnel / port forward traffic from localhost:9200 on the EC2 instance to the actual Elastic Search service (via that VPC endpoint).
It seems this command is where the magic happens:
ssh -i ~/.ssh/your-key.pem ec2-user#your-ec2-instance-public-ip -N -L 9200:vpc-your-amazon-es-domain.region.es.amazonaws.com:443
but that is for a Linux EC2 instance.
If I am Remote Desktopped into my Windows EC2 instance (the API), how can I make it so when I go to a browser, http://localhost:9200
will send traffic to my VPC Endpoint:
vpc-your-amazon-es-domain.region.es.amazonaws.com:443
Thanks!
Alright, so I'll answer my two questions:
First, it's actually quite easy, just RDP to your box and access the instance directly via the VPC endpoint. You don't need to do anything wacky like port forwarding using the netsh command or anything like that. Simply make sure the server (in my case my API) is on the same VPC and you're fine. I just had an error in my connection string that's why it didn't connect. To confirm, I RDP'D in and was able to hit the endpoint directly in a browser on port 80. While it's true the actual Elasticsearch runs on port 9200, you don't need to forward to localhost:9200 --> vpc:9200.
Now, regarding the second question, about hitting it locally, I think the problem is that because this service lacks a public IP address and you can't access it, that you can go through some complicated setup on AWS, or easier is just set it up to run locally for now until you are ready to use the VPC one (and thus your code will just run). Another option is to use security groups and make a publicly accessible cluster for now, and then when your code is done, search service/layer done, etc, you can start anew with a VPC/secure Elasticsearch service and that should be it.
Another thing that many mention is that it is cheaper/you have more control of things if you setup your own Elasticsearch on your local machine, and then set one up on EC2 (this is just reading blogs and seeing people mention how much frustration they had with it).
I have a test application running at
http://ec2-34-215-196-193.us-west-2.compute.amazonaws.com/
(This is a Test application, it wont be live for long. When I try to add a CNAME to this, like the screenshot below
. is added by the DNS system.
However, my app seems to be accessible only via us-west-2.compute.amazonaws.com or us-west-2.compute.amazonaws.com.
I can make it to resolve it either one of them.
But adding anything, does not seem to resolve with a CNAME. It gives 503 Service Unavailable.
I am using AWS EC2 to host the app with a HAProxy Load Balancer.
Using Google Domains for DNS Name.
Any suggestions for troubleshooting this problem?
All dns entries have a dot in the end like subdomain.domain.com.
It's not suggested to create CNAMEs to your ec2 instance because that IP may vary in time and it's not reassignable, that's what elastic ip's are made for, just create an elastic IP, assign it to your ec2 instance and assign it as an A record on your DNS provider.
Amazon AWS documentation
First create elastic IP and assign to your instance. Then create A record and point IP. Your site should work normal.
I have encountered a strange issue with getting ERR_CONNECTION_REFUSED when I don't have DNS hostnames enabled in my custom VPC.
I have created a VPC with one subnet (public), one route table, and an Internet gateway.
My route table has a route to my Internet gateway. I am using the default Network ACL. My SG has ports 1024-65535 open (<--- this is just a test!).
I create an instance from the AWS Linux AMI and put it in my public subnet. When my VPC is configured to assign DNS hostnames via enabling in "Edit DNS Hostnames", then I can reach my instance from my browser. (Instance is a Nodejs web service). All works fine, and network interface flow logs verify traffic is reaching my instance.
I disable the DNS hostname creation in my VPC via "Edit DNS Hostnames". I create a new instance following the same steps. It does not have DNS hostnames as expected (private nor public), but it does have a public IP address. When I try to connect to my instance via public IP via browser, I get ERR_CONNECTION_REFUSED.
It appears that I can readily reproduce this error with success/failure via enable/disable DNS hostnames.
Am I missing something in my configuration? Is this a known issue? Am I smoking crack?
Thanks.
Issue was Nodejs web service is failing to find the hostname for binding...because I was pulling the hostname to bind from the meta-data in the #!/bin/bash UserData script:
# Grab the EC2 instance internal DNS and configure the Hapi server host value
localhost=$(curl http://169.254.169.254/latest/meta-data/local-hostname)
rm -f ServerHost.js
echo -n "module.exports = \"" > ServerHost.js
echo -n "$localhost" >> ServerHost.js
echo "\"" >> ServerHost.js
But since there is no private DNS (because the default when manually creating a VPC is 'disable'), then there is no 'local-hostname'.