3

I have three instances in two separate VPCs. I've set up peering between the VPCs, both VPCs have DNS Resolution and DNS Hostnames enabled, the peering connection has "Allow DNS resolution from peer VPC [...]" enabled, and the routing tables for both VPCs have entries to route across the peering connection to the other VPC's address space.

Let's call them Instance 1 (which resides in VPC A), and Instances 2 and 3 (which reside in VPC B)...

With my current setup, calling nslookup ec2-[instance2].compute-1.amazonaws.com on instance 1 returns the 10.x.x.x address for instance 2, and the amazonaws.com hostname for instance 3 returns the 10.x.x.x address for instance 3. This is as expected.

HOWEVER, when I call nslookup ec2-[instance1].compute-1.amazonaws.com from instance 2 or instance 3, it returns the 54.x.x.x public address for instance 1 instead of its 10.x.x.x address.

What am I missing or doing wrong? I've been able to do this before (many moons ago), I don't get why it's not working now.

2
  • the peering connection has "Allow DNS resolution from peer VPC [...]" enabled is this an option that needs to be configured on both sides (and if so, have you)? Commented Feb 25, 2017 at 6:19
  • no, there is only one peering connection between the two VPCs and it only has the one check box.
    – Doktor J
    Commented Feb 27, 2017 at 19:00

1 Answer 1

4

The console doesn't seem to allow you to configure this on both sides of the connection when the same AWS account owns both the "requester" and "accepter" VPCs, so one-way resolution appears to be the only thing you can actually configure from the console -- only the requester VPC's hosts can be resolved.

It appears that you can fix this with aws-cli.

aws ec2 modify-vpc-peering-connection-options \
    --vpc-peering-connection-id 'pcx-xxxxxxxx" \
    --requester-peering-connection-options '{"AllowDnsResolutionFromRemoteVpc":true}' \
    --accepter-peering-connection-options '{"AllowDnsResolutionFromRemoteVpc":true}' \
    --region us-east-1

Line breaks for clarity, supply your VPCs' region with the --region option and your peering connection ID with --vpc-peering-connection-id.

Indeed, the above does change the value returned by aws ec2 describe-vpc-peering-connections, which previously showed false on one side and true on the other after checking the box in the console.

It's somewhat unusual but not unheard-of for capabilities not to be included in the console, but to be accessible only via the APIs.

2
  • Thanks for the tip; I will try it tomorrow and accept if it works!
    – Doktor J
    Commented Feb 28, 2017 at 3:06
  • Worked like a charm! Tried it yesterday and now nslookup ec2-[instance1].compute-1.amazonaws.com returns the appropriate 10.x.x.x address from instance2! Answer accepted :)
    – Doktor J
    Commented Mar 2, 2017 at 15:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .