Child pages
  • CommIT VPC DNS and VPN Setup
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »


In order to test different CommIT environments, it is necessary to override the authoritative DNS server(s) for the domain with one that directs the user to the front door  (loadbalancer) for the CPR and IDP instances in the desired environment.  To that end, we have set up separate DNS servers for the CommIT VPC-Dev and VPC-Prod environments.  These are configured to serve up the A and/or CNAME records for and for the specific VPC environment.

Currently, the DNS server for VPC-Dev runs on the CommIT VPC Gitolite server in the VPC-Dev public subnet and is accessible at EIP address  The DNS server for VPC-Prod runs on a t2.micro instance in the VPC-Prod public subnet and is accessible at EIP address


yum -y install bind

Configure /etc/named.conf and zone files, /var/named/masters/commonidtrust-dev.local and /var/named/masters/ (see examples for VPC-Dev attached).

chkconfig named on


named logs to /var/log/messages

Start/Stop Commands

/etc/init.d/named start

/etc/init.d/named stop

Open Nameserver Protection

Since users who need to leverage the VPC DNS servers are speckled around the internet and not accessing them from a well-defined IP address or CIDR block, we needed to leave the VPC DNS servers open to serve requests from anywhere.  This is done by configuring:


Unknown macro: { all; }


Furthermore, once a client is configured to use these DNS servers, they may need to access additional name servers, for example, those for  We therefore configured:

recursion yes;

Of course, it didn't take very long for some nefarious outfit to realize this and set up a DNS amplification attack (see ricocheting off of our open DNS server.  To resolve this, we downloaded, built and deployed bind 9.10.1 which includes rate-limit support.  This binary for this version is installed in /usr/local/sbin/named and the configuration file is in /usr/local/etc/named.conf.  It uses the same zone files in /var/named/masters as the bind 9.8.2 rpm package.

To start this version:

/usr/local/sbin/named -u named

To stop this version:

ps -ef | grep named

kill <pid> returned above

  • No labels