JKim's questions

I'm trying to migrate an existing domain to Amazon Route 53. I've followed the guide at:

http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/MigratingDNS.html

My current DNS host is web24.com.au. There seem to be two areas where the NS records are stored. I looked in the zone file and updated the NS entries to point to Amazon Route53. Changing those seems to have made no difference (checked via whois).

I've noticed another section in the configuration portal specifically for nameserver, but in order to change them from the default, I'm being asked to enter both the FQDN of the new name servers and also its IP address.

Amazon have not said anything about the IP address of their name servers (the "Delegation Set"), and I suppose it's simple enough to ping them and get their IPs that way. But I'm wondering if those name servers are clusters and it's not intended that I supply a single IP address for them.

Is it safe for me to just ping each of the servers in the Route 53 delegation set and use the IP addresses I see when I ping it when transferring the domain from Web24.com.au to Route 53?

I'm using OpenVPN Access Server 1.8.4.213 in Amazon VPC. I've used the custom AMI that has OpenVPN Access Server preinstalled.

My VPC is 10.11.0.0/16 My public subnet is 10.11.1.0/24

OpenVPN Server: 10.11.1.10 + ElasticIP Test Server: 10.11.1.20

VPN Subnet is dynamic and is the default 5.5.0.0/20

Once connection is established, my workstation (VPN client) gets an IP of 5.5.8.3 On the VPN Server, ifconfig shows two related IPs: 5.5.0.1, 5.5.8.1

In Advanced VPN -> I've set "Should clients be able to communicate with each other on the VPN network?" to Yes.

I've set Access Server to route mode and it's nearly all working: From my workstation, I can connect to the VPN server and ping it on its private IP (10.11.1.10). I can also ping and get replies to a server behind it on 10.11.1.20 (I've set up a route in Amazon VPC admin console).

From the Access Server, I can ping my workstation IP on 5.5.8.3

However, from the server in Amazon VPC at 10.11.1.20, I cant ping my workstation at 5.5.8.3 I do get ping replies from 5.5.0.1 and 5.5.8.1

How do I set this up so that from 10.11.1.20 I can ping my workstation at 5.5.8.3? Have I misconfigured something in Access Server, or can't I set it up like that using the GUI?

In Amazon VPC, the VPC creation wizard allows one to create a single "public subnet" or have the wizard create a "public subnet" and a "private subnet". Initially, the public and private subnet option seemed good for security reasons, allowing webservers to be put in the public subnet and database servers to go in the private subnet.

But I've since learned that EC2 instances in the public subnet are not reachable from the Internet unless you associate an Amazon ElasticIP with the EC2 instance. So it seems with just a single public subnet configuration, one could just opt to not associate an ElasticIP with the database servers and end up with the same sort of security.

Can anyone explain the advantages of a public + private subnet configuration? Are the advantages of this config more to do with auto-scaling, or is it actually less secure to have a single public subnet?