Answers: <blockquote>
    <p>Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel?</p>
  </blockquote>
  
  <p>Directly? No. The recursive resolver available by default when you create a VPC can only be accessed by an IP address in that VPC. This is a restriction that Amazon imposes.</p>
  
  <p>What you can do is create a forwarder using the <a href="https://aws.amazon.com/blogs/aws/new-amazon-route-53-resolver-for-hybrid-clouds/" rel="nofollow noreferrer">Route 53 Resolver service</a> or software like <a href="https://nlnetlabs.nl/projects/unbound/about/" rel="nofollow noreferrer">Unbound</a>. You can then (conditionally) forward your onprem DNS for certain domains to it.</p>
  
  <p>Some useful links:</p>
  
  <p><a href="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html#AmazonDNS" rel="nofollow noreferrer">https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html#AmazonDNS</a></p>
  
  <p><a href="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-support" rel="nofollow noreferrer">https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-support</a></p>
  
  <p><a href="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-06-20T21:28:48.770Z
Answers: 2019-06-20T21:28:48.770Z
Answers: user2640621
Body: <p>Currently I have an AWS VPC connected to our corporate network using AWS Site-to-Site VPN.</p>
  
  <p>I can reach my EC2 instances trough the tunnel by their private IP Address.</p>
  
  <p>Inside the VPC each EC2 instance can resolve private DNS hostnames <code>ip-private-ipv4-address.region.compute.internal</code> using the provided Amazon DNS server (reachable at IP address <code>VPN-CIDR</code> +2)</p>
  
  <p>Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel?</p>
  
  <p>The goal I want to achieve is the possibility to reach EC2 instances through VPN using a DNS name without create each time a record in our DNS.</p>
  
Tags: <amazon-web-services><dns><aws-vpc><vpn>
Title: Using Amazon VPC provided DNS trough AWS Site-to-Site VPN
UserDisplayName: sgargel
ThreadText: # Using Amazon VPC provided DNS trough AWS Site-to-Site VPN
  
  (Asked by: username_0 on 2019-06-20)
  
  Currently I have an AWS VPC connected to our corporate network using AWS Site-to-Site VPN.
  
  I can reach my EC2 instances trough the tunnel by their private IP Address.
  
  Inside the VPC each EC2 instance can resolve private DNS hostnames `ip-private-ipv4-address.region.compute.internal` using the provided Amazon DNS server (reachable at IP address `VPN-CIDR` +2)
  
  Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel?
  
  The goal I want to achieve is the possibility to reach EC2 instances through VPN using a DNS name without create each time a record in our DNS.
  
  **Tags:** amazon-web-services, dns, aws-vpc, vpn
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-06-20. Score: 2 | Accepted answer
  
  > Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel?
  
  Directly? No. The recursive resolver available by default when you create a VPC can only be accessed by an IP address in that VPC. This is a restriction that Amazon imposes.
  
  What you can do is create a forwarder using the [Route 53 Resolver service](https://aws.amazon.com/blogs/aws/new-amazon-route-53-resolver-for-hybrid-clouds/) or software like [Unbound](https://nlnetlabs.nl/projects/unbound/about/). You can then (conditionally) forward your onprem DNS for certain domains to it.
  
  Some useful links:
  
  <https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html#AmazonDNS>
  
  <https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-support>
  
  <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html>
  
  
  ---
  
  