0
  • AWS enterprise VPC
  • http proxy exists

    1. Without the HTTP proxy, curl http://169.254.169.254/lastest/meta-data successful, but disconnect to the Internet. This IP address is not Category A, B, C. Use this URI to get the meta-data from AWS.

    2. With the HTTP proxy, curl the same URI failed, but can connect to Intenet.

So I was thinking the reason. Per my understanding,

If there is not HTTP proxy, a URI firstly get the IP from DNS, then based on the route table to send this request to Internet or Ethernet. If there is HTTP proxy, from which stage the request will be sent to HTTP proxy?

Without DNS stage, the URI is directly sent to HTTP proxy and do the DNS work in HTTP proxy?

So confusing around this...

1

There are a few things to point out about your question's content which should answer you:

  • An IP address does not generate a DNS lookup. It simply generates a connection request that gets routed.
  • The existence of a proxy server on any system does not in itself decide what happens with the traffic. What does is the routing table and firewall rules.
  • The Internet is not a physical connection type and most likely goes through your Ethernet port. What determines if you have Internet access or not is again based on the routing table and firewall rules on your machine, but may also be affected by those on the host system.

It would therefore most likely be possible to get both scenarios working to get your AWS meta-data if you make the proper routing and firewall rules.

|improve this answer|||||
  • Yeah, I know the first and second points. For the third one, my curiosity is the sequence. curl something, how the machine knows the URI should go to HTTP proxy to make a request to Internet or go to a gateway to an Internal web service? – cdhit Jul 23 '16 at 3:39
  • As I said, it's a combination of the routing table and firewall rules. If you look at the routing table when you start your proxy, you may notice the default gateway going to it, but it could also be done through the firewall. – Julie Pelletier Jul 23 '16 at 4:05
1

The IP 169.254.169.254 is in the network block 168.254.0.0/16 allocated for Automatic Private IP Addressing. It should never be routed to the internet. If your IP address is in the block you will not have direct connectivity to the internet. However, you may be able to use a proxy to connect to sites on the internet.

There are a number of mechanisms that can be used to discover a proxy server:

  • DHCP can include a proxy server option. This does not apply to Automatic Private IP Addressing.
  • Web Proxy Autodiscovery Protocol provides a mechanism for proxy discovery.
  • Proxies can announce themselves using the Zeroconf protocol.

If you get an address by some mechanism other than Automatic Private IP Addressing, it is unlikely you will be able to communicate with servers in that network block.

HTTP works with either IP addresses or DNS domain names. Using IP addresses limits the functionality of the server as it can't multiplex domains. Many servers offer Virtual Hosts where multiple hosts share the same IP address, and routing is done by the Host header. It is possible to use an IP address, and inject a Host header into the request. However, URLs in the response may not work unless you have a working name resolution service. This is usually provide by DNS, but can be done by other mechanisms including mDNS (Zeroconf) and host files.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.