Join Log in
Score:0
ilgtech avatar Ubuntu

DNS Issues: resolving amazon DNS names with special characters

se flag
ilgtech

I set up an AWS VPN Endpoint last night. This is its DNS name (identifiable info removed):

*.cvpn-endpoint-xxxxxxxxxxxxxxxx.prod.clientvpn.us-xxxxx-1.amazonaws.com

When I create an .ovpn file and install it in network-manager it won't connect. Running:

journalctl -u NetworkManager -b

returns:

RESOLVE: Cannot resolve host address: companyvpn.domainname.com:443 (Name or service not known)

I can run the nslookup command against any public DNS or my internal private DNS servers and it shows me the correct IP addresses. If I use the ping command, it doesn't know what to do with that name.

I also have Network Solutions as a DNS provider so I registered a CNAME. One that has non special characters in it: companyvpn.domainname.com for example. It still won't resolve but again nslookup to the CNAME will pull back the canonical name which is the original *.cvpn-endpoint-xxxxxxxxxxxxxxxx.prod.clientvpn.us-xxxx-1.amazonaws.com and it returns the proper IP address.

I tried pinging companyvpn.domainname.com from a Windows machine. It resolves just fine and showed me the canonical name and it's corresponding IP address. Why won't the resolver in Ubuntu 18.04 do that?

I put in a hostname entry in /etc/hosts for companyvpn.domainname.com and that worked fine but it's because I'm bypassing the resolution of the AWS name that has the special characters.

How can I use the DNS resolver in Ubuntu to resolve my domain name?

46
0 + 0
dns
in flag
matigo
You will likely want to verify the security group policies for the instance allow the machine to communicate with the outside world.
0
Reply
James S. avatar
de flag
James S.
asterisks are not permissible in any FQDN, and as a result, a resolver is not required to handle it. see rfc-1035: https://datatracker.ietf.org/doc/html/rfc1035
0
Reply
ilgtech avatar
se flag
ilgtech
Thanks, I understand the asterisk is basically the issue, but why would amazon advertise their VPN endpoints with such DNS naming conventions? That was me just thinking out loud. I understand this is a Ubuntu forum apologies. I guess it's back to the drawing board. It works in windows dns resolution stack without issue. But systemd resolved service won't. It's one of the first times where I have seen linux doing something not as well as windows.
0
Reply
Score:0
ilgtech avatar Ubuntu
se flag
ilgtech

Hi all I found the answer to this:

" *.cvpn-endpoint-xxxxxxxxxxxxxxxx.prod.clientvpn.us-xxxx-1.amazonaws.com "

The asterisk (*) represents "[random-string-here]"

I put: " vpn.cvpn-endpoint-xxxxxxxxxxxxxxxx.prod.clientvpn.us-xxxx-1.amazonaws.com "

Then I referenced that target in my CNAME registration. It resolves perfectly. I'm all set. Thanks all.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.