EC2实例可Ping通IP但无法解析DNS地址的问题排查

问题描述 #

我在eu-west-3区域的公有子网中拥有一台Ubuntu EC2实例，能够成功执行curl访问网站、Ping IP地址，但执行ping google.com这类域名时出现DNS失败错误。

相关配置信息 #

/etc/resolv.conf内容 #

nameserver 127.0.0.53
options edns0
search eu-west-3.compute.internal

Terraform配置代码 #

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 2.21.0"

  name = "${local.env_type}-vpc"
  cidr = local.workspace["net_cidr"]

  azs             = ["eu-west-3a", "eu-west-3b"]
  private_subnets = local.workspace["private_subnets"]
  public_subnets  = local.workspace["public_subnets"]

  enable_nat_gateway           = true
  single_nat_gateway           = true
  reuse_nat_ips                = false
  enable_vpn_gateway           = false
  enable_dns_hostnames         = true
  create_database_subnet_group = true

  enable_ipv6                                    = true
  assign_ipv6_address_on_creation                = true
  private_subnet_assign_ipv6_address_on_creation = false

  public_subnet_ipv6_prefixes   = [0, 1]
  private_subnet_ipv6_prefixes  = [2, 3]
  database_subnet_ipv6_prefixes = [4, 5]

  database_subnets = local.workspace["database_subnets"]

  tags = {
    ManagedByTerraform = "true"
    EnvironmentType    = "${local.env_type}"
  }
}

resource "aws_security_group" "public_instance" {
  #vpc_id = module.vpc.vpc_id
  ingress {
    from_port = 22
    to_port   = 22
    protocol  = "tcp"

    # Note that opening to 0.0.0.0/0 can lead to security vulnerabilities.
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    from_port = 8080
    to_port   = 8080
    protocol  = "tcp"

    # Note that opening to 0.0.0.0/0 can lead to security vulnerabilities.
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "ubuntu_vm" {
  ami                  = "ami-064736ff8301af3ee"
  instance_type        = "t3.medium"
  key_name             = "aws-key"
  iam_instance_profile = aws_iam_instance_profile.instance_pcb_profile.id
  security_groups = [
    aws_security_group.public_instance.id
  ]
  tags = {
    Name = "pcb-${local.env_type}"
  }
}

resource "aws_eip" "ip" {
  vpc      = true
  instance = aws_instance.ubuntu_vm.id
}

可能的问题点及解决方法 #

1. VPC DNS支持配置不完整 #

AWS VPC需要同时开启enable_dns_support和enable_dns_hostnames，才能让EC2实例正常获取并使用VPC内置DNS服务器（地址为VPC CIDR段的第二个IP，如VPC CIDR是10.0.0.0/16则为10.0.0.2）。

• 你的Terraform VPC模块已设置enable_dns_hostnames = true，建议显式添加enable_dns_support = true（模块默认值为true，但显式配置可避免版本差异或默认值变更风险）：

  module "vpc" {
    # ... 其他原有配置 ...
    enable_dns_support = true
    enable_dns_hostnames = true
    # ... 其他原有配置 ...
  }
  

2. Systemd-resolved本地缓存未正确关联VPC DNS #

Ubuntu 18.04+默认使用systemd-resolved服务，/etc/resolv.conf中的127.0.0.53是本地DNS缓存服务，而非实际的DNS服务器。需要确认它是否正确转发请求到VPC DNS：

• 执行命令resolvectl status查看上游DNS服务器列表，确认是否包含VPC的DNS地址
• 如果未获取到正确的上游DNS，可手动编辑/etc/systemd/resolved.conf添加VPC DNS地址：

  [Resolve]
  DNS=你的VPC_DNS_IP
  FallbackDNS=8.8.8.8 8.8.4.4
  

  之后重启服务：systemctl restart systemd-resolved

3. 网络ACL限制DNS流量 #

安全组已放行所有出方向流量，但VPC的网络ACL可能限制了DNS（UDP 53端口）的出站请求：

• 检查公有子网关联的网络ACL，确保出站规则允许UDP协议的53端口访问VPC DNS地址或0.0.0.0/0
• 同时确认入站规则允许UDP 53的响应流量（部分场景需要）

4. EC2实例未指定公有子网 #

你的Terraform代码中aws_instance资源未配置subnet_id，可能导致实例被随机放置到VPC的任意子网（包括私有子网）。需要显式指定公有子网ID：

resource "aws_instance" "ubuntu_vm" {
  # ... 其他原有配置 ...
  subnet_id = module.vpc.public_subnets[0] # 可根据需求选择对应可用区的公有子网
  # ... 其他原有配置 ...
}

内容的提问来源于stack exchange，提问作者nolwww