DNS-ga gaarka ah wuxuu ka shaqeeyaa VPC laakiin ma aha VPN
Magac gaar ah oo lagu xalliyo EC2 laakiin aan VPN lagu xallin waa dhibaato jidka resolver-ka. Akhri qaabka guuldarrada ka hor intaadan tafatirin diiwaanka aagga.
Magac gaar ah ayaa laga xalliyaa EC2 laakiin ma aha laga xalliyo kombuyuutar la socda oo VPN ku xiran, iyo aaggu wuxuu u muuqdaa mid sax ah konsolka. Dareenka ugu horreeya waa in diiwaanka wax laga beddelo, taas oo aanay casi ahaanayn dhibaatada. Diiwaanku waxa uu u jawaabayaa qof; kaliya kuma jawaabayo kombuyuutarkaaga. Farqiga u dhexeeya labada wacaya waa resolver-ka ay weydiiyaan iyo haddii resolver-kaas uu leeyahay jid la taageeray oo galo aragtida DNS ee VPC.
Waxaan ku bilaabaa caddaynta in diiwaanku jiro, ka dib waqtiga intiisa kale waxaan ku qaataa jidka weydiinta. Kuwani waa nidaamyo kala duwan oo u guuldareysta siyaabo kala duwan.
Akhri qaabka guuldarrada ka hor intaadan wax beddelin
Saddex natiijo ayaa macneheedu saddex waxyaabood oo kala duwan, iyo hal weydiin ayaa kala saarta: socodsi dig magaca ka soo horjeeda resolver-ka macmiilku dhab ahaan isticmaalo.
| What you see | What it usually means | First thing to check |
|---|---|---|
| SERVFAIL, or a timeout after several seconds | No path to the resolver, or the resolver cannot reach AWS | Route to the endpoint and the security policy on port 53 |
| NXDOMAIN from a resolver that did answer | The resolver replied, but the zone is not in its view | Zone association or the forwarding rule for that namespace |
| A public address for an internal name | Split DNS is not in effect for this client | Which resolver the client is configured to use |
Waqti dhaqan waa hadal ku saabsan shabakadda. NXDOMAIN waa hadal ku saabsan aragtida DNS. Jawaab dadweyne waa hadal ku saabsan siyaasadda. Tafatirka diiwaanka aagga inta waqti dhaqan jiro waxa uu tuurayaa caddaynta kaliya ee faa'iido leh ee kiiska.
Sababta ciwaanka lagu daro laba ee VPC uusan ahayn resolver fog
Ciwaanka CIDR lagu daro laba waa adeeg maxalli ah oo loogu talagalay kheyraadka gudaha VPC. AWS waxa ay diiwaan gelisaa in gudbinta weydiimaha laga soo diro shabakadaha gudaha, ama laga soo diro server-yada DNS ee VPC kale, si toos ah ciwaankaas lama taageerayo waxaana laga yaabaa in ay soo saarto natiijooyin aan degganayn.
Taasi macneheedu maaha in tijaabo aanay waligeed u muuqan mid shaqeynaya. Waxa ay ka dhigan tahay in dhaqanku aanu ahayn heshiis lagu ridi karo qoraalka caawinaada. Jihada la taageeray waa Resolver endpoint soo gala: laba ciwaan oo gudaha VPC-gaaga ah, laga gaari karo shabakadda aad maamusho, oo aqbala weydiimaha ka imanaya meel ka baxsan AWS.
Dhis jidka sida ay ugu guuldareysto si nadiif ah
Waa in ay jiraan saddex boodbood, mid kastaana wuxuu leeyahay habkiisa guuldarreysiga.
VPN client -> approved DNS forwarder
forwarder -> forwarding rule for internal.example
forwarding rule -> Resolver inbound endpoint addressesGudbiyaha wuxuu u baahan yahay marin uu kaga tago ciwaannada endpoint-ka isagoo maraya VPN, jidka soo noqoshadana waa in uu shaqeeyaa. DNS caadiga ah ee dekedda 53 endpoint-ku waxa uu kaga jawaabaa UDP iyo TCP, sidaas darteed waa in labada borotokool la oggolaado oo labaduba waa in ay ka badbaadaan baaritaan kasta oo xaaladeed oo dhexda ku yaal.
Kadib si gooni ah u baar aragtida DNS. Aagga martigelinta gaarka ah waxa uu u muuqdaa oo kaliya VPC-yada lala xidhiidhiyay, ama iyada oo loo marayo hab sharing oo ula kac ah. Endpoint la gaari karo keligiis kama dhigayo aag kasta oo gaar ah mid lagu xallin karo macnaha xallintiisa.
Endpoint baxa wuxuu u adeegaa jihada ka soo horjeeda mana ka jawaabayo weydiin ka soo gasha kombuyuutarkaaga.
Xaqiiji labada gees
Weydii macmiilka oo ka soo horjeeda gudbiyaha, kadib gudbiyaha oo ka soo horjeeda endpoint-ka. Haddii macmiilku guuldareysto halka gudbiyuhu guulaysto, farqiga wuxuu u dhexeeyaa labadaas.
Haddii labaduba guuldareystaan, eeg siyaasadda amniga endpoint-ka iyo ciwaanka isha ee uu dhab ahaan arko. Gudbiye ka dambeeya NAT waxa uu soo bandhigaa ciwaanka NAT halkii ciwaanka VPN ee kombuyuutarka, farqigaas oo keliyaana wuu ku filan yahay in weydiinta la tuuro. Haddii labaduba guulaystaan laakiin abka wali guuldareysto, waxa laga yaabaa in abku isticmaalo resolver kale oo aan ahayn kii aad tijaabisay.
Kala sooc meelaha magacyada dadweynaha iyo kuwa gaarka ah si ula kac ah. Split DNS waa siyaasad aad habaysato, ma aha saameyn dhinac ah oo ka timaadda hal raadin oo si kadis ah xog u soo celiyay.
Waxa aanan samayn lahaa
Kuma dari lahaa qaanuun NAT oo hal raadin shaqeeyay oo aan ugu yeedho naqshad.
Kuma jeedin lahaa macmiil kasta oo fog ciwaanka lagu daro laba sababtoo ah hal tijaabo ayaa mar soo celiyay diiwaan. Mana ballaarin lahaa siyaasadda amniga endpoint-ka oo dhan barkada VPN marka hal gudbiye uu u baahan yahay gelitaan. Haddii ururku horey u socodsiiyo gudbiye la ansixiyay gudaha VPC, marka hore akhri naqshaddaas, sababtoo ah endpoint-ka labaad ee aad ku darto waa kan aan qofna diiwaan gelin.