Translated from 日本語 • View original I want to send an email to the host in the back segment (for example, the one that doesn't have an EIP in the VPC, or the one you want to smell in the back, such as a DB or NAS) to name resolution, email, yum, wget, time synchronization, etc.! I will give a rough summary of the settings in this case.
For the time being, there are two patterns. The pattern of NAT (using a NAT instance in the case of AWS) and the pattern of putting software into a management server that can communicate globally is solved.
★NAT (using NAT instances on AWS) pattern
If the db side does not have an Internet Gateway and is routing locally instead of public, you will not be able to go out, including name resolution. （※） When I tried to convert a web with multiple NICs into NAT, it seemed that a multi-interface instance could not be used as an exit for NAT. Recently, the new account I took is VPC-only, and it seems that the global IP is being manipulated more and more arbitrarily. (Specifications that must be attached to the EIP)
How to create a NAT instance from the following URL: Amazon VPC Training - How to Create a NAT Instance VPC Details - Almost Weekly AWS Meister Series Part 7 - Using NAT in Amazon VPC to Separate Public and Private Subnets
You can create a NAT instance as shown in the top slide. Roughly speaking, create a VPC subnet, create a NAT instance with the "ami-vpc-nat" AMI, make the NAT instance's "Change Source/DestCheck" Disable, associate the EIP to the NAT instance, add the NAT instance's ID to the RouterTable in the PublicSubnet, and Configure the SecurityGroup for the NAT instance as needed
In addition, it seems that it is necessary to set NAT rules in iptables after instance creation, as in the general routerization configuration method.
/sbin/iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/16 -j MASQUERADE
service iptables save
iptables --list -t nat
As shown in the slide above, you also need to set up a routing setting to make the NAT instance the default gateway.
# vi /etc/sysctl.conf
----------------------------------------------------
net.ipv4.ip_forward = 0
↓
net.ipv4.ip_forward = 1
----------------------------------------------------
# sysctl -p
Routerization Configuration Method (NAT) Creating a Linux Router Using the NAT Table
After NAT conversion, specify the default gateway on the client side as the NAT server
Add a new default gateway
# /sbin/route add default gw 10.0.0.251 dev eth0
# netstat -rn
Remove the old default gateway
# /sbin/route del default gw 10.0.0.2 dev eth0
# netstat -rn
Confirm
# ping yahoo.co.jp
★ A pattern that solves the problem by inserting software into a management server that can communicate globally
For the time being, let's start with the name solution. bind.
・Build an internal DNS Reference: Build an internal DNS server
@DNS Server Side
# rpm -qa|grep bind
bind-utils-9.3.6-20.P1.el5_8.5
ypbind-1.19-12.el5_6.1
bind-libs-9.3.6-20.P1.el5_8.5
yum install bind.x86_64 bind-devel.x86_64
Installed:
bind.x86_64 30:9.3.6-20.P1.el5_8.6
bind-devel.x86_64 30:9.3.6-20.P1.el5_8.6
Dependency Installed:
bind-libs.i386 30:9.3.6-20.P1.el5_8.6
Dependency Updated:
bind-libs.x86_64 30:9.3.6-20.P1.el5_8.6
bind-utils.x86_64 30:9.3.6-20.P1.el5_8.6
vi /etc/named.conf
---------------
options {
Where to store zone files
directory "/var/named";
Specify the scope of BIND usage
allow-query {
Own (localhost)
127.0.0.1;
// 10.0.0.* ( Subnet 255.255.255.0 )
10.0.0.0/24;
};
Slave DNS addresses. In the case of inbound DNS, it is not necessary, but it is listed for the time being.
allow-transfer {
Own (localhost)
127.0.0.1;
// 10.0.0.* ( Subnet 255.255.255.0 )
10.0.0.0/24;
};
If you can't resolve the name yourself, first go to the provider's DNS to ask for it.
It seems to lead to improved performance of name resolution in the LAN. 2003/07/29 Postscript
forwarders {
211.132.xxx.xxx; ISAO Primary DNS IP Address
211.132.xxx.xxx; ISAO Secondary DNS IP Address
};
};
Root DNS Information
zone "." {
Indicate that it is the root DNS information
type hint;
File name
file "named.ca";
};
Setting up a localhost forward draw
zone "localhost" {
Indicate that it is a Master DNS Server
type master;
File name
file "localhost.zone";
};
Configuring Reverse LocalHost Lookup
zone "0.0.127.in-addr.arpa" {
Clearly state that it is a Master DNS Server
type master;
File name
file "0.0.127.in-addr.arpa";
};
Configuring a Reverse Lookup for 10.0.0.*
zone "0.0.10.in-addr.arpa" {
Clearly state that it is a Master DNS Server
type master;
File name
file "empty";
};
---------------
wget ftp://ftp.nic.ad.jp/internet/rs.internic.net/domain/named.root
cp named.root /var/named/named.ca
vi /var/named/empty
-----------------------------------------------------------
; BIND reverse data file for empty rfc1918 zone
;
; DO NOT EDIT THIS FILE - it is used for multiple zones.
; Instead, copy it, edit named.conf, and use that copy.
;
$TTL 86400
@ IN SOA localhost root.localhost. (
1 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
86400 ) ; Negative Cache TTL
;
@ IN NS localhost.
-----------------------------------------------------------
vi /var/named/localhost.zone
----
$TTL 86400
@ IN SOA @ root (
1 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
86400 ) ; Negative Cache TTL
IN NS @
IN A 127.0.0.1
----
vi /var/named/0.0.127.in-addr.arpa
----
$TTL 86400
@ IN SOA localhost. root.localhost. (
1 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
86400 ) ; Negative Cache TTL
IN NS localhost.
1 IN PTR localhost.
----
vi /etc/sysconfig/named
OPTIONS="-4"
/etc/init.d/named start
ps -ef|grep named
named 4801 1 0 12:02 ? 00:00:00 /usr/sbin/named -u named -4
chkconfig named on
@DNS Client-side
vi /etc/resolv.conf
---
nameserver 10.0.0.10
nameserver 10.0.0.2
# dig +noall +answer www.isao.net
www.isao.net. 1800 IN A 218.42.137.171
# dig +noall +answer www.yahoo.co.jp
www.yahoo.co.jp. 372 IN CNAME www.g.yahoo.co.jp.
www.g.yahoo.co.jp. 17 IN A 124.83.203.233
*The reason why I bind is because I'm used to it. Unbound seems to be easier. See below. I installed Unbound
This alone can solve the name, but not yum. Since bind alone can only solve names, I can add squid and ntpd to do yum, wget, and ntpdate from the NAS.
・Build a forward proxy and do yum, wget, and curl
*It is not a reverse proxy that speeds up the web server front-end. It is better to cache content to speed up (or regulate) downloads from within.
@プロキシサーバ側
yum install squid.x86_64 --enablerepo=epel
Installed:
squid.x86_64 7:2.6.STABLE21-6.el5
cp -p /etc/squid/squid.conf{,.`date +%Y%m%d`}
vim /etc/squid/squid.conf
diff /etc/squid/squid.conf{,.`date +%Y%m%d`}
590d589
< acl lan src 10.0.0.0/255.255.255.0
638d636
< http_access allow lan
2795,2797d2792
< header_access X-Forwarded-For deny all
< header_access Via deny all
< header_access Cache-Control deny all
3012d3006
< visible_hostname xx-stg.isao.net
4284c4278
< forwarded_for off
---
> # forwarded_for on
service squid start
chkconfig squid on
netstat -lnpt|grep squid
tcp 0 0 0.0.0.0:3128 0.0.0.0:* LISTEN 5010/(squid)
@クライアント側
vi /etc/yum.conf
--
proxy=http://10.0.0.10:3128/
--
yum grouplist
vi ~/.wgetrc
--
http_proxy=10.0.0.10:3128
--
vi ~/.curlrc
--
proxy=http://10.0.0.10:3128
--
*Specifying proxies for wget, etc. By the way, git, gem, vagrant, etc. were written here.
To install the repository, refer to RPMforge EPEL ELRepo Remi Repository Installation ・Set up NTPD for time synchronization @ntp server side
touch /etc/ntp.drift
cp -p /etc/ntp.conf{,.org}
vi /etc/ntp.conf
---
server ntp.nict.jp
server ntp.jst.mfeed.ad.jp
driftfile /etc/ntp.drift
---
service ntpd start
chkconfig ntpd on
ntpq -p
remote refid st t when poll reach delay offset jitter
==============================================================================
ntp.nict.jp 133.243.238.243 2 u 2 64 3 33.951 -102.58 3.204
ntp2.jst.mfeed. 210.173.160.86 2 u 2 64 3 2.568 -102.27 2.897
@ntp Client-side
ntpdate 10.0.0.10
# ntpdate -b 10.0.0.10
24 Jan 14:58:55 ntpdate[6730]: step time server 10.0.0.10 offset 0.070994 sec
# crontab -e
# crontab -l
0 * * * * /usr/sbin/ntpdate -bs 10.0.0.10 > /dev/null 2>&1
In the case of the cloud, we have heard that the time is easy to shift, and if the time is off, the time in the log and DB may be shifted, and the impact on the application may be serious. I think you need to set it up without forgetting it.
★Settings when you want to forward emails from inside the LAN to the MTA server
・In the case of sendmail, @MTA settings Set to accept email forwarding from locally Introduce the rpm required to compile the sendmail.cf
# yum install sendmail-cf
Modifying Settings
# cd /etc/mail
# cp -p sendmail.mc{,.`date +%Y%m%d`}
# vi sendmail.mc
dnl DAEMON_OPTIONS(`Port=smtp,Addr=10.0.0.251, Name=MTA')dnl
LOCAL_DOMAIN(`mydmainname.com')dnl
*RELAY is restricted by allowing permission from all directions ()
# cp -p access{,.`date +%Y%m%d`}
# vi access
Connect:localhost.localdomain RELAY
Connect:localhost RELAY
Connect:127.0.0.1 RELAY
Connect:10.0.0 RELAY
Updating Settings
# makemap -v hash /etc/mail/access.db < /etc/mail/access
# m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
Sendmail Restart
# /etc/init.d/sendmail restart
@メールクライアントの設定 Backup
# cp -p /etc/mail/submit.cf{,.org} ; ls -al /etc/mail/submit.cf*
# cp -p /etc/mail/local-host-names{,.org}; ls -al /etc/mail/local-host-names*
Changing settings
# Specify the hostname of the client that will be the domain of DJ_HOSTNAME=from
# sed -i 's/^#Dj\$w.Foo.COM$/\0\nDj'${DJ_HOSTNAME}'/' /etc/mail/submit.cf
# echo ${DJ_HOSTNAME} >> /etc/mail/local-host-names
# sed -i "s/D{MTAHost}\[127\.0\.0\.1\]/D{MTAHost}[10.0.0.251]/g" /etc/mail/submit.cf
*Specify the email MTA address in MTAHost *If you do not set Dj, the domain written instead of localhost in the third column of line 127.0.0.1 in /etc/hosts will be from.
Compare and confirm
# diff /etc/mail/submit.cf{,.org}
# diff /etc/mail/local-host-names{,.org}
Finally, confirm the sending with the mail command
# mail -s title-testmail hoge＠gmail.com
If you need a DKIM or SPF record, set it separately.
・In the case of postfix@メールサーバ側の設定
# vi /etc/postfix/main.cf
---
mynetworks = 54.249.xxx.xxx/32, 10.122.4.56/32, 10.121.18.78/32 54.249.xxx.xxx/32
---
# service postfix reload
*Allow from local (the above is an AWS environment that is not a VPC, so /32 is specified, but if it is a VPC, /24, etc. is OK) *Other settings are assumed to be completed accordingly.
@メールクライアントの設定
# vi /etc/postfix/main.cf
---
myhostname = [FQDN of client host]
relayhost = [FQDN of MTA]
---
# service postfix reload
・In the case of qmail, write to tcp.smtp to allow RELAY and update the hash DB.
# cp -p tcp.smtp{,.`date +%Y%m%d`}
# vi tcp.smtp
10.0.0.:allow,RELAYCLIENT=""
# tcprules /etc/tcp.smtp.cdb /etc/tcp.smtp.tmp < /etc/tcp.smtp
If vpopmail is also included
# /home/vpopmail/bin/clearopensmtp
Check the contents of the DB
# cdbdump < /home/vpopmail/etc/tcp.smtp.cdb > ./tcp.smtp.`date +%Y%m%d`.txt
*The client side should check if it is sendmail or postfix *Please check the PATH as appropriate
Without a NAT instance, it seems that the configuration will be a little complicated. If you want to keep it simple, I think NAT is better. However, if you have a management server but have multiple IFs or NAT instance fees are a waste, you can solve the problem by adding an app.