I-DNS yangasese isebenza ku-VPC kodwa hhayi ku-VPN
Igama langasese elixazululwa ngaphakathi kwe-EC2 kodwa hhayi ku-VPN iyinkinga yendlela ye-resolver. Funda isimo sokwehluleka ngaphambi kokuhlela irekhodi lezoni.
Igama langasese lixazululwa lisuka ku-instance ye-EC2 kodwa hhayi kusuka kukhompyutha ephathwayo exhunywe nge-VPN, futhi isoni sibonakala silungile kukhonsoli. Umcabango wokuqala ukuhlela irekhodi, okuvamise ukungabi yinkinga. Irekhodi liphendula othile; aliphenduli nje ikhompyutha yakho ephathwayo. Umehluko phakathi kwababili ababizayo ukuthi yiluphi i-resolver abayibuzayo, nokuthi iyona i-resolver inendlela esekelwayo yokungena embonini ye-DNS ye-VPC.
Ngiqala ngokufakazela ukuthi irekhodi likhona, bese ngichitha isikhathi esisele endleleni yombuzo. Lezi zinhlelo ezihlukene futhi ziyehluleka ngezindlela ezihlukene.
Funda isimo sokwehluleka ngaphambi kokushintsha noma yini
Imiphumela emithathu isho izinto ezintathu ezihlukene, futhi umbuzo owodwa uyahlukanisa: sebenzisa i-dig yegama elibhekene ne-resolver esetshenziswa ngiklayenti ngempela.
| What you see | What it usually means | First thing to check |
|---|---|---|
| SERVFAIL, or a timeout after several seconds | No path to the resolver, or the resolver cannot reach AWS | Route to the endpoint and the security policy on port 53 |
| NXDOMAIN from a resolver that did answer | The resolver replied, but the zone is not in its view | Zone association or the forwarding rule for that namespace |
| A public address for an internal name | Split DNS is not in effect for this client | Which resolver the client is configured to use |
Isikhathi sokuphela siyisitatimende mayelana nenethiwekhi. I-NXDOMAIN isitatimende mayelana nombono we-DNS. Impendulo yomphakathi isitatimende mayelana nenqubomgomo. Ukuhlela irekhodi lezoni ngesikhathi sokuphela kulahla ubufakazi obunye obuwusizo ecaleni.
Kungani ikheli le-plus-two le-VPC lingeyona i-resolver ekude
Ikheli le-CIDR plus-two liyinsizakalo yasendaweni yezinsiza ngaphakathi kwe-VPC. I-AWS ibhala phansi ukuthi ukudlulisela imibuzo isuka kunethiwekhi yasendaweni, noma isuka kumaseva e-DNS e-VPC enye, ngqo kulelo kheli akusekelwe futhi kungaveza imiphumela engazinzile.
Lokho akusho ukuthi ucwaningo alubonakali lusebenza neze. Kusho ukuthi ukuziphatha akusona isivumelwano ongasifaka kuskripthi losizo. Indlela esekelwayo iyi-Resolver endpoint engenayo: ipheya lamakheli ngaphakathi kwe-VPC yakho, efinyeleleka kunethiwekhi oyilawulayo, eyamukela imibuzo eza ngaphandle kwe-AWS.
Akha indlela ngokulandelana lapho yehluleka khona ngokuhlanzekile
Kufanele kube namagxathu amathathu, futhi ngalinye linendlela yalo yokwehluleka.
VPN client -> approved DNS forwarder
forwarder -> forwarding rule for internal.example
forwarding rule -> Resolver inbound endpoint addressesIsidluliseli sidinga indlela eya emakhelini e-endpoint nge-VPN, futhi indlela yokubuya kufanele isebenze. Nge-DNS evamile kupoti 53 i-endpoint iphendula nge-UDP ne-TCP, ngakho zombili izinhlelo kufanele zivunyelwe futhi zombili kufanele zidlule noma yikuphi ukuhlolwa kwesimo phakathi.
Bese uhlola umbono we-DNS ngokwehlukana. Ithoni elisingathwe ngasese libonakala kuphela kuma-VPC elixhunywe kuwo, noma ngesivumelwano sokwabelana sangamabomu. I-endpoint efinyelelekayo ayenzi yodwa ukuthi zonke izoni zangasese zixazululeke kumongo wayo wokuxazulula.
I-endpoint ephumayo isebenzela indlela ephambene futhi ngeke iphendule umbuzo ongena usuka kukhompyutha yakho ephathwayo.
Qinisekisa kuzo zombili iziphetho
Buza kusuka kuklayenti mayelana nesidluliseli, bese usuka kusidluliseli mayelana ne-endpoint. Uma iklayenti lehluleka ngesikhathi isidluliseli siphumelela, igebe liphakathi kwalabo babili.
Uma zombili zehluleka, bheka inqubomgomo yokuphepha ku-endpoint nekheli lomthombo elikubona ngempela. Isidluliseli esingemuva kwe-NAT siveza ikheli le-NAT esikhundleni sekheli le-VPN lekhompyutha ephathwayo, futhi lowo mehluko wodwa wanele ukulahla umbuzo. Uma zombili ziphumelela kodwa uhlelo lusahluleka, kungenzeka uhlelo lusebenzisa enye i-resolver kunaleyo oyihlolile.
Gcina izikhala zamagama zomphakathi nezingasese zihlukene ngamabomu. I-Split DNS iyinqubomgomo oyimisayo, hhayi umphumela oseceleni wokusesha okukodwa okuveze idatha ngengozi.
Engingeke ngikwenze
Ngeke ngeneze umthetho we-NAT owenza ukusesha okukodwa kusebenze bese ngikubiza lokho ngokuthi umklamo.
Ngeke ngibhekise wonke iklayenti elikude ekhelini le-plus-two ngenxa yokuthi ucwaningo olulodwa lwabuyisa irekhodi kanye. Futhi ngeke ngikhulise inqubomgomo yokuphepha ye-endpoint kulo lonke ichibi le-VPN lapho isidluliseli esisodwa sidinga ukufinyelela. Uma inhlangano isivele igcina isidluliseli esigunyaziwe ngaphakathi kwe-VPC, funda lowo mklamo kuqala, ngoba i-endpoint yesibili oyengezayo iyona okungekho muntu oyibhalayo.