Hi, everyone, and welcome back.
Now, in today's video, we are going to discuss about the hybrid DNS.
Now, in larger organizations, one of the common architecture pattern that you will see is that they
are based on a hybrid setup.
So one part of infrastructure might be in a second part of infrastructure might be in the on premise
data center, Azure, etc..
Now, when you have a hybrid setup, one of the challenging things is related to the overall DNS resolution.
And this is something that we will be discussing in today's video.
Now, before we understand things in detail, let's revise the basics related to the private hosted
zone at a high level overview.
The private hosted zone contains the record that specify how you want to route the traffic in an Amazon
VPC.
For example, let's say that you have a private hosted zone and there are certain set of records and
there are two EPCs.
Now, by default, these VPC will not be able to perform resolution based on these records.
So what you need to do, you have to go ahead and associate the VPC with a private hosted zone and only
after this association, the resources in the VPC will be able to go ahead and perform the resolution.
Now, at this stage, since the VPC number two is not associated, the EC, two instances in this VPC
will not be able to resolve the records of this specific private hosted zone.
Now let me also quickly show you.
So at this stage I have a private hosted zone call demo dot internal.
The type you see is private now associated with this zone.
If I quickly edit the zone, you have an option related to associating a VPC with this zone.
And at this stage you see there is only one VPC that is associated.
You also have the option of associating multiple set of VPC associated with this zone in a way that
all of these records that are part of this zone will be resolvable by the resources that is associated
with the VPC.
Now, one very important part to remember is that the Route 53 does not respond to the queries which
are not originating from the VPC.
For example, let's say you have a private hosted zone and you have a VPC number one that is associated
with this zone, and there is also a VPC number two, and there is a peering between both of these VPC.
So the easy two instance in VPC two will be able to communicate to the EC, two instance in VPC one
and vice versa.
Now since the VPC one has access to the private hosted zone, it is assumed that the resources in the
VPC number two through this peering connection will be able to also resolve the records that are part
of the private hosted zone.
However, that is not the case.
So if an easy two from the VPC number two sends the query for this specific record.
For example, 01. demo dot internal to the VPC number one plus two address.
It will not be resolvable.
So let's go ahead and also quickly look into this.
Now, similar to this specific architecture, I already have the infrastructure setup in place.
So in the account number one, I have an easy to instance that is running and I have one more easy two
instance that is running in account number two and both of the VPC in which the EC two is running,
these VPC are appeared.
For example, if we look into the peering connection, you see there is a peering between the account
number one and account number two VPC.
And similar to this diagram, there is a private hosted zone that is associated with the VPC number
one.
Let me also show you.
So if you look into the association, it is associated with one of the VPC, which we are calling as
VPC number one.
Now, from the terminal, I am already connected to both of these EC two instances.
So first EC two instance has an IP of 1077 zero 172.
Now if you see you have 1077 zero 172 and second one has an IP of one 7231 And if you look over here
you have one 7231.
So before we proceed, let's go ahead and first verify whether the connectivity is successfully present.
So from the account number two, EC two, I'll go ahead and I'll do a ping on the EC two associated
with account number one.
And as expected, at this stage, the ping connectivity is successfully there.
Now, at this stage the second point is very important where we were discussing the VPC plus two address.
So this is the address related to the overall resolution.
So generally, let me quickly show you if we'll go to the ETSI result conf.
You have the plus to address.
So if the VPC CIDR is 1070 700 16, then the name server would be 1077 0.2.
All right.
Now if you do a lookup on say, google.com on this address, 1077 0.2 again, if you don't mention it,
will take this as default.
But just to avoid confusion, I'm adding it here.
You see, the resolution is working perfectly well.
Similarly, if you try the resolution associated with the private hosted zone domain, let's try it
out.
I'll say 01. demo dot internal.
And you see, the resolution is also working perfectly well.
Now, since there is already a connectivity between VPC one and VPC two, it is assumed that the instance
in the VPC two, if that instance also sends this specific DNS query on this plus two address, the
resolution will work.
However, we just learned that this is something that is not supported, so let's try it out.
So if I run the exact same command over here, you see, we are not really getting any response here.
And at this stage we got a connection timed out stating no servers could be reached.
So this is what the first pointer means where we say that the Route 53 will not respond to the queries
that are not originating from the VPC.
Now, at this stage we discussed about the VPC peering.
However, this can be any kind of a setup.
For example, if we discuss about the hybrid architecture where you have a VPC one and you have an on
premise and there is a connectivity either via VPN and direct connect, even in such cases, if the
resources in on premise tries to connect to the VPC one plus two IP address for resolution, this kind
of a setup is not supported.
Now, since there are many organizations that are actively using such kind of a setup, the question
is what is the probable solution to get it working?
And one of the probable solution here is to introduce a DNS server.
So if you look into this specific probable architecture, what you will do first, you will host the
custom DNS server in the VPC.
So this is an easy to instance.
Then the on premise sends the queries to the custom DNS server.
So from on premise, instead of sending to the plus two IP address, you send it to the IP address of
this custom DNS server.
Now, this custom DNS server will forward the query to the appropriate Route 53 resolver.
And from here, whatever response that this custom DNS server will receive, it will forward the response
back to the on premise.
And this is one of the very common architectures that you will generally see in organization.
It works pretty well.
However, there are certain challenges to this kind of architecture.
First primary one is that the customer has to manage the custom DNS server, so all the things related
to high availability, security, scalability optimization becomes the customer's responsibility.
Now, what happens due to some reason that this EC2 instance related to custom DNS server goes down,
the entire DNS resolution will stop working and this will affect the overall application.
And this is one of the reasons why it has introduced the root 53 resolver endpoints that allows us to
communicate to the private hosts or domains from outside the VPC.
So here, instead of the custom DNS server, we are introducing the resolver endpoint.
And the benefit of this resolver endpoint is that it takes care of the entire infrastructure here.
So you don't really have to worry much about high availability, security optimization, etc. Let us
take care of it.
All you'll have to do is create a resolver endpoint and send the query to the IP address associated
with this endpoint and your entire DNS setup is done for you.
And nowadays most of the organizations, they are now migrating from the custom DNS server approach
that we were discussing to that of this resolver endpoint.
Now again, the feature sets of resolver endpoint provides a lot of flexibility.
We will be discussing about this in the appropriate video.
However, from the architectural perspective, I hope you got an idea on what are the solutions associated
when you have a hybrid kind of a setup.
So with this will conclude today's video.