0

I have an infrastructure where all requests made by internal subnets have to pass through a server in the "open to the world" subnet, where my NAT instance is (I'm using AWS).

I want to create a host name to be used internally, that is, any requests made by the internal instances to example.com should be redirected by the NAT instance to some specific internal instance.

I already have haproxy in my NAT instance. It is forwarding incoming traffic to example.com to some internal ip address. If I change an internal instance's /etc/hosts with:

172.31.10.123 example.com (where 172.31.10.123 is the ip address for the NAT instance)

the requests from such internal instance is correctly redirected. The problem is I would have to modify the /etc/hosts file to every instance and I don't want that.

So, since all traffic to the web should pass through the NAT instance, is it possible to check if a host destination is example.com and redirect it to my specific internal instance's ip address?

3
  • It would potentially be helpful to understand why you need to do this. Route 53 has private hosted zones that are automatically visible to all the instances in your VPC, and this seems like the simple/obvious solution, depending on what you are actually trying to accomplish. Oct 28, 2015 at 17:13
  • @Michael-sqlbot, I was trying to avoid having to pay for it. But I guess it is the easiest way indeed. Thank you!
    – brunodea
    Oct 28, 2015 at 17:18
  • It is so cheap that any other solution will cost you far more in time and hassle. If you are just trying to implement internal/private DNS, it's the way to go. If these hostnames are externally associated with Elastic IPs but you want internal translations, there is another approach... Oct 28, 2015 at 17:26

2 Answers 2

0

you need to use internal DNS and let instance use this DNS. You can do it in different ways:

  1. Setup BIND or another DNS server
  2. Use Route53 from AWS
  3. Use internal hostnames to connecting

Best idea is setup your own BIND server, but you need to study about DNS for it.

After you will have you internal DNS (BIND or Route53), you have to modify /etc/resolv.conf or DHCPOption of VPC to reflect this and let know your instances about your internal DNS.

0

I don't think I am misunderstanding the question, but what about putting in an itpables rule on your haproxy instance that checks the source and if it originates from your internal network, NATs to 172.31.10.123?

Haproxy as acl's as well, that you can use to redirect based on source IP is iptables is not an option.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .