AWS: VPC peering DNS resolution and DNS settings for OpenVPN Access Server
Tags: aws, dns, networking, openvpn
Published: 2019-05-17 14:47:30

---
title: AWS: VPC peering DNS resolution and DNS settings for OpenVPN Access Server
published: true
tags: AWS,DNS,Networking,OpenVPN
canonical_url: https://rtfm.co.ua/en/aws-vpc-peering-dns-resolution-and-dns-settings-for-openvpn-access-server/
---

![](https://rtfm.co.ua/wp-content/uploads/2014/11/aws-logo-square-02-e1417012834176-1.png)We have a VPC with OpenVPN Access Server running. This VPC is connected with other VPCs in our AWS account.

The issue is that currently when a user is connected to VPN for the DNS resolution into EC2 instances private IPs we are using `dnsmasq` service on the VPN-host which has a `/etc/dnsmasq.hosts` file where are manually added private IPs for necessary domains.

You can read more about the current setup in the [OpenVPN: настройки DNS и dnsmasq](https://rtfm.co.ua/openvpn-nastrojki-dns-i-dnsmasq/) post (Rus).

More correct way is to use AWS VPC’s DNS Resolve option. You can read more about DNS in AWS VPC in the [DNS: установка BIND, DNS Load Balancing и network-based routing через view](https://rtfm.co.ua/dns-ustanovka-bind-dns-load-balancing-i-network-based-routing-cherez-view/#DNS_AWS) post (Rus).

VPC DNS Resolution documentation – [Enabling DNS Resolution Support for a VPC Peering Connection](https://docs.aws.amazon.com/en_us/vpc/latest/peering/modify-peering-connections.html).

The post below describes configuring DNS resolution between VPC with OpenVPN and VPC with ЕС2 where we have our Bitwarden passwords manager running (see [Bitwarden: an organization’s password manager self-hosted version installation on an AWS EC2](https://dev.to/setevoy/bitwarden-an-organization-s-password-manager-self-hosted-version-installation-on-an-aws-ec2-1plg)). This ЕС2 has Elastic IP attached, and there is domain name _accounts.example.com_ which is pointed to this EIP via AN A record.

### DNS Hostnames

Docs – [DNS Support in Your VPC](https://docs.aws.amazon.com/en_us/vpc/latest/userguide/vpc-dns.html#vpc-dns-support).

If a VPC has no _DNS Hostnames_ enabled – first need to turn it on.

Then VPC will assign public domain names to public IPs for instances in this VPC which can be used then to resolve them to private IPs.

I.e. when resolving a domain from the world – it will be resolved to its public IP but if call it from a VPC – it will be resolved to a private IP of an instance in this VPC.

Go to the VPC, find your VPC, select _Edit DNS Hostnames_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_111032.png "AWS: VPC peering DNS resolution и настройки DNS для OpenVPN AS")](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_111032.png)

Enable the _DNS Hostnames_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_111325.png "AWS: VPC peering DNS resolution и настройки DNS для OpenVPN AS")](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_111325.png)

### DNS Resolution via VPC Peering

Next – turn on DNS resolution via between VPCs via their peering.

Go to the _VPC > Peering Connections_, chose your peering, select _Edit DNS Settings_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_110639.png "AWS: VPC peering DNS resolution и настройки DNS для OpenVPN AS")](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_110639.png)

Enable both options here:

[![](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_110729.png "AWS: VPC peering DNS resolution и настройки DNS для OpenVPN AS")](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_110729.png)

Now let’s check.

First from the office, to check DNS resolution from the world:


```
[setevoy@setevoy-arch-work ~] $ dig ec2-63-***-***-138.eu-west-1.compute.amazonaws.com +short
63.***.***.138
```

And now – from the host where is OpenVPN is running, to check how the resolution will work from via VPC peering:

```
openvpnas@openvpnas2:~$ dig ec2-63-***-***-138.eu-west-1.compute.amazonaws.com +short
172.31.41.159
```

172.31.41.159 – is the private IP of the Bitwarden instance, all good.

### Route53

Next, need to update Route53 record for the _accounts.examle.com_ domain, as it has `IN A` with Public IP of the Bitwarden’s EC2. Change it to `CNAME` and set the Public DNS name of this instance:

[![](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_115441.png "AWS: VPC peering DNS resolution и настройки DNS для OpenVPN AS")](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_115441.png)

Wait a couple of minutes to propagate DNS, and check from the office again:

```
[setevoy@setevoy-arch-work ~] $ dig accounts.examle.com +short
ec2-***-***-252-138.eu-west-1.compute.amazonaws.com.
63.***.***.138
```

And from the OpenVPN instance:

```
openvpnas@openvpnas2:~$ dig accounts.examle.com +short
ec2-63-***-***-138.eu-west-1.compute.amazonaws.com.
172.31.41.159
```

Again got 172.31.41.159 – all works.

### DNS in the OpenVPN

Go to the _VPN Settings_ and set a private IP of a DNS in this VPC.

DNS in a VPC always as address like _<network>.2_.

In this current case, we have VPC for OpenVPN with the _10.0.10.0/24_ CIDR,  therefore DNS will be on the _10.0.10.2_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_120829.png "AWS: VPC peering DNS resolution и настройки DNS для OpenVPN AS")](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_120829.png)

You can check if DNS is available from any host in this VPC:

```
openvpnas@openvpnas2:~$ dig @10.0.10.2 ya.ru +short
87.250.250.242
```

Now go to the OpenVPN admin page and set DNS:

[![](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_121007.png "AWS: VPC peering DNS resolution и настройки DNS для OpenVPN AS")](https://rtfm.co.ua/wp-content/uploads/2019/05/Screenshot_20190516_121007.png)

Connect to the VPN from the office:

```
[setevoy@setevoy-arch-work ~] $ sudo openvpn --config vpnroot-client.ovpn
...
Thu May 16 12:05:31 2019 /etc/openvpn/update-resolv-conf tun0 1500 1553 172.27.240.75 255.255.248.0 init
dhcp-option DNS 10.0.10.2
...
```

And check the _accounts.examle.com_ domain:

```
[setevoy@setevoy-arch-work ~] $ dig accounts.examle.com +short
ec2-63-***-***-138.eu-west-1.compute.amazonaws.com.
172.31.41.159
```

_172.31.41.159_ again – all works.

Done.

### Similar posts

- <small>02/21/2019</small> [OpenVPN: OpenVPN Access Server set up and AWS VPC peering configuration](https://dev.to/setevoy/openvpn-openvpn-access-server-set-up-and-aws-vpc-peering-configuration-5fpg)<small> (0)</small>  
- <small>02/22/2019</small> [OpenVPN: DNS and dnsmasq configuration](https://dev.to/setevoy/openvpn-dns-and-dnsmasq-configuration-225f)<small> (0)</small>