<blockquote>
  <p>Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel?</p>
</blockquote>

<p>Directly? No. The recursive resolver available by default when you create a VPC can only be accessed by an IP address in that VPC. This is a restriction that Amazon imposes.</p>

<p>What you can do is create a forwarder using the <a href="https://aws.amazon.com/blogs/aws/new-amazon-route-53-resolver-for-hybrid-clouds/" rel="nofollow noreferrer">Route 53 Resolver service</a> or software like <a href="https://nlnetlabs.nl/projects/unbound/about/" rel="nofollow noreferrer">Unbound</a>. You can then (conditionally) forward your onprem DNS for certain domains to it.</p>

<p>Some useful links:</p>

<p><a href="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html#AmazonDNS" rel="nofollow noreferrer">https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html#AmazonDNS</a></p>

<p><a href="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-support" rel="nofollow noreferrer">https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-support</a></p>

<p><a href="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html</a></p>

CC BY-SA 4.0
2019-06-20T21:28:48.770Z
2019-06-20T21:28:48.770Z
user2640621
<p>Currently I have an AWS VPC connected to our corporate network using AWS Site-to-Site VPN.</p>

<p>I can reach my EC2 instances trough the tunnel by their private IP Address.</p>

<p>Inside the VPC each EC2 instance can resolve private DNS hostnames <code>ip-private-ipv4-address.region.compute.internal</code> using the provided Amazon DNS server (reachable at IP address <code>VPN-CIDR</code> +2)</p>

<p>Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel?</p>

<p>The goal I want to achieve is the possibility to reach EC2 instances through VPN using a DNS name without create each time a record in our DNS.</p>

<amazon-web-services><dns><aws-vpc><vpn>
Using Amazon VPC provided DNS trough AWS Site-to-Site VPN
sgargel
# Using Amazon VPC provided DNS trough AWS Site-to-Site VPN

(Asked by: username_0 on 2019-06-20)

Currently I have an AWS VPC connected to our corporate network using AWS Site-to-Site VPN.

I can reach my EC2 instances trough the tunnel by their private IP Address.

Inside the VPC each EC2 instance can resolve private DNS hostnames `ip-private-ipv4-address.region.compute.internal` using the provided Amazon DNS server (reachable at IP address `VPN-CIDR` +2)

Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel?

The goal I want to achieve is the possibility to reach EC2 instances through VPN using a DNS name without create each time a record in our DNS.

**Tags:** amazon-web-services, dns, aws-vpc, vpn


---

## 1 answers

### Answer by username_1 on 2019-06-20. Score: 2 | Accepted answer

> Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel?

Directly? No. The recursive resolver available by default when you create a VPC can only be accessed by an IP address in that VPC. This is a restriction that Amazon imposes.

What you can do is create a forwarder using the [Route 53 Resolver service](https://aws.amazon.com/blogs/aws/new-amazon-route-53-resolver-for-hybrid-clouds/) or software like [Unbound](https://nlnetlabs.nl/projects/unbound/about/). You can then (conditionally) forward your onprem DNS for certain domains to it.

Some useful links:

<https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html#AmazonDNS>

<https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-support>

<https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html>


---

