Amazon Route53 with Private Hosted Zone - Ping Works, Web Connection Fails

1
votes

I've read through all the white papers for Route53, Private Hosted Zones, and Workspaces and I'm too the point of banging my head on the wall. :p

I'm having trouble getting an EC2 instance and an Amazon Workspace within a private cloud to communicate using a Fully Qualified Domain Name. I need them to communicate with a FQDN instead of an IP address so that I can have an encrypted connection with an SSL.

Here is my configuration:

  • Setup a VPC with two public subnets, a route table, and internet gateway.
  • VPC is setup with DNSResolution and DNSHostnames enabled.
  • Setup a Simple AD for the workspace within the private VPC.
  • Setup an EC2 instance within the private VPC with a public subnet.
  • Setup the EC2 instance with a security group that allows port 80,443, and 5003 open to 0.0.0.0/0.
  • Setup a workspace within the private VPC with no security group.
  • Disabled the firewall within the EC2 instance and Workspace.
  • Setup a Hosted Zone on Route53 configured for Private and linked to the VPC.
  • Setup an A Record pointing the private IP of the EC2 instance.

If I run a ping from the Workspace to the DNS record that was setup in Route53, I get a successful connection.

If I try to reach the EC2 server using a Web browser on Port 80 or Port 443 using the DNS record, it fails.

If I try to reach the Ec2 server using an application that runs on Port 5003 using the DNS record, it fails.

If I try to reach the EC2 server with either web browser or application by referencing the IP, it is successful. So I know that my ports aren't being blocked.

Did I configure the route53 record incorrectly or am I missing a particular IAM Role permission set?

Thanks and let me know if I need to elaborate on any of the configuration.

1
amazon-web-servicesamazon-ec2dnsamazon-route53
You didn't mention that ICMP is allowed in the security group and ping doesn't actually create a connection. Why are you using a public subnet? Also is the R53 A record set to the private IP of the EC2 instance? - NHol
I'm new to networks, so I assumed ping was a "connection" since most tutorials and videos online show people "pinging" a server to make sure it is there. Why would a ping to a domain resolve properly, but an actual connection won't? I even tried making all TCP ports open. I setup a public subnet because this ec2 instance will need to be accessible remotely. The R53 A record is set to the private IP of the EC2 instance. - Jeff Henry
What happens if you run "nslookup <fqdn>" and "nslookup -a <ipaddress>" without the quotes on the workspace? - NHol
"nslookup server.host.com" returned Server: AWS-0415DE10AD.server.host.com Address:10.0.2.167 Name: server.host.com - Jeff Henry
Is that the private IP address of your EC2 instance? - NHol

1 Answers

2
votes

SimpleAD DNS is being used instead of Route53. If the zone is the same then only one or the other can be used I'm afraid.

For example if you have host.com DNS zone in SimpleAD then the workspace won't use R53 for any *.host.com resolution. Try a different private zone in R53 and therefore fqdn for the EC2 instance private IP address.

https://forums.aws.amazon.com/thread.jspa?threadID=215126