SSH config: command for bastion server proxying

Host 51.21.21.11
  IdentityFile ~/.ssh/mykey.pem
  User ec2-user
  ForwardAgent yes

Host 10.*
  ProxyCommand ssh ec2-user@51.21.21.11 nc %h 22
  User ec2-user
  IdentityFile ~/.ssh/mykey.pem
  ForwardAgent yes

Put your ssh public key in ~/.ssh/authorized_keys along the path.

EC2 server to VPC private instance via VPC NAT instance

1. iptables -t nat -A PREROUTING -s 23.23.23.23/32 -d 10.0.0.254/32 -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 3306 -j DNAT --to-destination 10.0.12.10:3306
1. 23.23.23.23 is your external server's public IP address
2. 10.0.0.254 is your VPC NAT instance's IP address in the public subnet
3. 10.0.12.10 is the VPC IP address of your server in a private subnet
4. 3306 is the port your service is listening on

Set up private, internal DNS for your VPC using Route 53 and unbound

CRITICAL: AWS now offers internal VPC DNS! Below is no longer necessary AFAIK. Woo hoo!

http://aws.amazon.com/about-aws/whats-new/2014/11/05/amazon-route-53-now-supports-private-dns-with-amazon-vpc/

BELOW IS DEPRECATED!

1. create a Hosted Zone, something like "mydomain.internal"
2. get the IP addresses of the name servers assigned to your new zone
1. STRIP OFF '.' at the end of the name servers or BOOM!
3.  create a new DHCP Options Set
1. add the IP addresses you gathered above to the domain-name-servers field
4. Change DHCP Options Set of your VPC by right-clicking it
5. run sudo dhclient on any already-running instance in the VPC to pick up changes
6. debug changes have taken place on an instance: cat /etc/resolv.conf

RECOMMEND ALTERNATE SOLUTION: here's a sample unbound.conf I ended up using for a DNS forwarding server within my VPC -- see comments below. I adjusted the "options set" to point at this DNS server instead, 10.0.0.254 in my case.

NOTE: Btw, unbound is available under "epel" yum repo.

server:
        verbosity: 1
        interface: 0.0.0.0
        access-control: 10.0.0.0/16 allow
forward-zone:
       name: "mydomain.internal"
       forward-host: ns-123.awsdns-12.com
       forward-host: ns-234.awsdns-34.biz
       forward-host: ns-567.awsdns-56.net
       forward-host: ns-890.awsdns-78.org
       forward-first: no 

See also:

unbound, custom records:  http://sysadminandnetworking.blogspot.com/2014/05/unbound-custom-records.html

unbound, default to google: http://sysadminandnetworking.blogspot.com/2014/05/unbound-default-to-googles-dns.html