3 ms·
Perhaps different use case - but I prefer to use a VPC with internal addressing and DNS. Particularly if you're using more than just a few instances. Then have
by jwilliams 13y ago
Perhaps different use case - but I prefer to use a VPC with internal addressing and DNS. Particularly if you're using more than just a few instances.
Then have a bastion host in a DMZ that forward to the actual instances (I prefer 172 as it tends to avoid clashing with wifi networks). This does cost you a m1.small Amazon instance, but if you reserve it the cost is negligible.
Even better. You can do this automagically with ssh by putting a suitable `ProxyCommand ssh <bastion> "nc %h %p"` in your ssh config. So you just `ssh 172.0.0.10` or ssh `my-internal-name.blah` and it tunnels straight in for you.
You can pair this with internal DNS if you want to get really fancy - although it's a bit fiddly. From what I read internal DNS is pretty high up on the Route 53 feature request list.
- tacticus 13y agoRoute 53 finally providing internal DNS for vpses would just be incredibly awesome.
- shrike 13y agoThere is a DNS service in every VPC now, that shipped earlier this year. New instances are automatically added. Is this what you are looking for - http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dn...
- throwaway2048 13y agoSSH now has a -W netcat mode, so your ssh config can be simplified to: ProxyCommand ssh -W %h:%p <bastion> this also means that netcat, or even a shell/ability to execute commands is not required on the remote bastion host.
- jwilliams 13y agoAh! I wasn't aware of that. I'll update my scripts.
- jbrownbridge 13y agoSo I use almost exactly the same approach except in the VPN configuration options (I use Ubuntu 12.04) I just set the search domain to my-internal-name.blah, as well as, making sure the VPN connection is only used for resources on its own network. Then as part of my bootstrapping I register the VPC instance's internal-ip address on route53 under the my-internal-name.blah zone. Then I can simply do ssh staging01, etc.