Wondering how to avoid DNS resolution failures in EC2? We can help you!
Here at Bobcares, we handle requests from our customers to handle DNS resolution failure issues as a part of our Server Management Services.
Today let’s see how our Support Engineers do this for our customers with EC2 instances.
How to Avoid DNS resolution failures in EC2
Generally, to decrease CPU, network usage and avoid DNS resolution failures we can apply a DNS cache.
However, when we use a DNS cache to query external DNS resources, the cache will answer most of the recurring queries locally without interacting with the DNS resolver over the network.
Following are some of the external DNS resources in AWS:
- Amazon Relational Database Service (Amazon RDS)
- The Amazon ElastiCache
- Amazon Simple Storage Service (Amazon S3)
We can fix this with the help of dnsmasq.
Steps to setup local DNS cache, using dnsmasq
Now we will see how our Support Engineers set up a local DNS cache, using dnsmasq (a DHCP and cache DNS server).
1. Firstly, we can install the dnsmasq server by running the following command:
sudo yum install -y dnsmasq2. Then we can create a dedicated system user to run dnsmasq using the following commands:
sudo groupadd -r dnsmasq
sudo useradd -r -g dnsmasq dnsmasqNote: dnsmasq typically runs as the root user, but drops root privileges after startup by changing to another user. And by default, the user is “nobody”.
3. Next, we will make a copy of the dnsmasq.conf file using the following command:
sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.orig
4. And open the configuration file using a text editor as given below:
sudo vim /etc/dnsmasq.conf5. Now we will edit the /etc/dnsmasq.conf file so that it is similar to the following:
# Server Configuration
listen-address=127.0.0.1
port=53
bind-interfaces
user=dnsmasq
group=dnsmasq
pid-file=/var/run/dnsmasq.pid
# Name resolution options
resolv-file=/etc/resolv.dnsmasq
cache-size=500
neg-ttl=60
domain-needed
bogus-priv6. After that we will create the /etc/resolv.dnsmasq file, and set the Amazon DNS server or the custom domain-name-servers that are specified on DHCP options sets.
sudo bash -c "echo 'nameserver 169.254.169.253' > /etc/resolv.dnsmasq"7. We can restart the dnsmasq server and set the service to start up on boot using the following commands:
Amazon Linux 1
sudo service dnsmasq restart
sudo chkconfig dnsmasq onAmazon Linux 2
sudo systemctl restart dnsmasq.service
sudo systemctl enable dnsmasq.service8. Then we can verify that dnsmasq is working correctly using the dig command given below:
dig aws.amazon.com @127.0.0.1If the result is similar to the following, then it is working correctly:
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.56.amzn1 <<>> aws.amazon.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25122
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;aws.amazon.com. IN A
;; ANSWER SECTION:
aws.amazon.com. 41 IN A 54.239.31.69
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
...9. After verification we can set the dnsmasq DNS cache as the default DNS resolver.
10. We can configure the default DNS resolver as a fallback option by using the following:
sudo bash -c "echo 'supersede domain-name-servers 127.0.0.1, 169.254.169.253;' >> /etc/dhcp/dhclient.conf"11. And we can either run the dhclient command or reboot the instance to apply the change:
sudo dhclientOR
sudo reboot12. To verify that the instance is using the DNS cache, we can run the dig command:
dig aws.amazon.comIf we get the following reply then the DNS cache is working correctly:
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.56.amzn1 <<>> aws.amazon.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1028
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;aws.amazon.com. IN A
;; ANSWER SECTION:
aws.amazon.com. 55 IN A 54.239.31.69
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) <<<-------
...Steps to automate the installation and configuration of dnsmasq as a DNS resolver
We can use one of the following to automate the installation and configuration of dnsmasq as a DNS resolver on Amazon Linux:
- AutomateDnsmasq.sh Bash script
- AutomateDnsmasq.cloudinit directives
Both the above files can run on VPC instances or EC2-Classic since they use the Amazon DNS server alternative address of 169.254.169.253 for VPC and 172.16.0.23 for EC2-Classic.
We can run either file at launch time by passing the contents of the file in the user data field. Moreover, we can run the Bash script as a standalone script or with an AWS Systems Manager run command to perform the actions on an existing instance.
For running the Bash script as a standalone script we must do the following:
1. Firstly, we have to download the script on our instance and make it executable.
For this, we can use the following command:
wget https://raw.githubusercontent.com/awslabs/aws-support-tools/master/EC2/AutomateDnsmasq/AutomateDnsmasq.sh
chmod +x AutomateDnsmasq.sh2. After that we can run the following command as a root user or use sudo.
sudo ./AutomateDnsmasq.sh[Need assistance? We can help you]
Conclusion
To conclude, we saw the steps that our Support Techs follow to Avoid DNS resolution failures in EC2.
0 Comments