Comment by jwilliams | Hacker News Reader

Comment by jwilliams | Hacker News Reader

Perhaps different use case - but I prefer to use a VPC with internal addressing and DNS. Particularly if you're using more than just a few instances.

Then have a bastion host in a DMZ that forward to the actual instances (I prefer 172 as it tends to avoid clashing with wifi networks). This does cost you a m1.small Amazon instance, but if you reserve it the cost is negligible.

Even better. You can do this automagically with ssh by putting a suitable `ProxyCommand ssh <bastion> "nc %h %p"` in your ssh config. So you just `ssh 172.0.0.10` or ssh `my-internal-name.blah` and it tunnels straight in for you.

You can pair this with internal DNS if you want to get really fancy - although it's a bit fiddly. From what I read internal DNS is pretty high up on the Route 53 feature request list.

SSH now has a -W netcat mode, so your ssh config can be simplified to:

       ProxyCommand ssh -W %h:%p <bastion>

this also means that netcat, or even a shell/ability to execute commands is not required on the remote bastion host.

Ah! I wasn't aware of that. I'll update my scripts.

Route 53 finally providing internal DNS for vpses would just be incredibly awesome.

There is a DNS service in every VPC now, that shipped earlier this year. New instances are automatically added. Is this what you are looking for -

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dn...

So I use almost exactly the same approach except in the VPN configuration options (I use Ubuntu 12.04) I just set the search domain to my-internal-name.blah, as well as, making sure the VPN connection is only used for resources on its own network.

Then as part of my bootstrapping I register the VPC instance's internal-ip address on route53 under the my-internal-name.blah zone.

Then I can simply do ssh staging01, etc.

Reply on news.ycombinator.com