1

I've read through all the white papers for Route53, Private Hosted Zones, and Workspaces and I'm too the point of banging my head on the wall. :p

I'm having trouble getting an EC2 instance and an Amazon Workspace within a private cloud to communicate using a Fully Qualified Domain Name. I need them to communicate with a FQDN instead of an IP address so that I can have an encrypted connection with an SSL.

Here is my configuration:

  • Setup a VPC with two public subnets, a route table, and internet gateway.
  • VPC is setup with DNSResolution and DNSHostnames enabled.
  • Setup a Simple AD for the workspace within the private VPC.
  • Setup an EC2 instance within the private VPC with a public subnet.
  • Setup the EC2 instance with a security group that allows port 80,443, and 5003 open to 0.0.0.0/0.
  • Setup a workspace within the private VPC with no security group.
  • Disabled the firewall within the EC2 instance and Workspace.
  • Setup a Hosted Zone on Route53 configured for Private and linked to the VPC.
  • Setup an A Record pointing the private IP of the EC2 instance.

If I run a ping from the Workspace to the DNS record that was setup in Route53, I get a successful connection.

If I try to reach the EC2 server using a Web browser on Port 80 or Port 443 using the DNS record, it fails.

If I try to reach the Ec2 server using an application that runs on Port 5003 using the DNS record, it fails.

If I try to reach the EC2 server with either web browser or application by referencing the IP, it is successful. So I know that my ports aren't being blocked.

Did I configure the route53 record incorrectly or am I missing a particular IAM Role permission set?

Thanks and let me know if I need to elaborate on any of the configuration.

6
  • You didn't mention that ICMP is allowed in the security group and ping doesn't actually create a connection. Why are you using a public subnet? Also is the R53 A record set to the private IP of the EC2 instance?
    – NHol
    May 18, 2017 at 18:13
  • I'm new to networks, so I assumed ping was a "connection" since most tutorials and videos online show people "pinging" a server to make sure it is there. Why would a ping to a domain resolve properly, but an actual connection won't? I even tried making all TCP ports open. I setup a public subnet because this ec2 instance will need to be accessible remotely. The R53 A record is set to the private IP of the EC2 instance.
    – Jeff Henry
    May 22, 2017 at 20:59
  • What happens if you run "nslookup <fqdn>" and "nslookup -a <ipaddress>" without the quotes on the workspace?
    – NHol
    May 23, 2017 at 6:59
  • "nslookup server.host.com" returned Server: AWS-0415DE10AD.server.host.com Address:10.0.2.167 Name: server.host.com
    – Jeff Henry
    May 23, 2017 at 21:01
  • Is that the private IP address of your EC2 instance?
    – NHol
    May 23, 2017 at 21:21

1 Answer 1

2

SimpleAD DNS is being used instead of Route53. If the zone is the same then only one or the other can be used I'm afraid.

For example if you have host.com DNS zone in SimpleAD then the workspace won't use R53 for any *.host.com resolution. Try a different private zone in R53 and therefore fqdn for the EC2 instance private IP address.

https://forums.aws.amazon.com/thread.jspa?threadID=215126

3
  • Interesting. Thank you for the forum link and clarifying this. Would upvote, but I don't have enough Rep yet. Thanks again, NHOL
    – Jeff Henry
    May 24, 2017 at 15:47
  • 1
    If anyone else comes across this situation, you need to install DNS tools on an EC2 instance that is part of the directory. Then connect to your directory's IP address and manage your A records using the dnsmgmt.msc application.
    – Jeff Henry
    May 24, 2017 at 16:58
  • Just leaving this here that this was exactly my problem - I had the same zone for my Simple AD as I did for R53. Thanks!
    – Drew
    Apr 22, 2021 at 1:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.