I have to create a private DNS on our aws infrastructure, that will be active when our developers are on our VPN connection (openvpn server). Since aws is a little different from what I've dealt with any info would be useful.

I looked for a couple of solutions, and I found that people suggest dnsmasq, bind server, and also some have suggested using Route53 in aws.

So if I want to use an internal DNS solution in a VPN connection (for security), what would be an efficient solution?

Update: The effect that I want is that some DNS entries for our testing domains (testserver.com) get resolved only when using a VPN connection. But when not using a VPN connection that the standard DNS resolvment kicks in. Maybe using a DNS forwarder would suffice for that task?

Tnx, Tom

  • All of these options are possible. How do you define efficient – Daniel Widrick Jan 10 '18 at 20:24
  • Hi Daniel, well that was maybe a poor choice of words, I'm looking for a solution that would easily integrate in aws and function properly. – Tomislav Mikulin Jan 10 '18 at 20:30
  • Update your question with more details. Do you want to implement your own DNS server in AWS VPC or create private resource records in Route53 that your on-premises system can access thru a DNS forwarder? – John Hanley Jan 11 '18 at 0:18
  • I updated the question. – Tomislav Mikulin Jan 11 '18 at 7:07
  1. Create a route 53 private hosted zone, attach it to the VPC.

  2. Create a Simple AD and attach it to the VPC, this will give you DNS server IP addresses.

  3. Add a conditional forwarder to your on premise DNS servers for the private route 53 zone.

This will require a site to site VPN connection between your network and AWS VPC, so the DNS server can do that look ups.

enter image description here



If you have integrated your on-premises network with one or more Amazon VPC virtual networks and you want your on-premises network to resolve domain names in private hosted zones, you can create a Simple AD directory. Simple AD provides IP addresses that you can use to submit DNS queries from your on-premises network to your private hosted zone. For more information, see Getting Started with Simple AD in the AWS Directory Service Administration Guide.


  • strongjz, can I use something like dnsmasq as a SimpleAD instead? Also I have multiple VPC-s, do I a separate dns forwarder for every VPC that I have on aws? Tom – Tomislav Mikulin Jan 14 '18 at 13:06
  • 1
    You can use dnsmasq if you want, you'll be responsible for the availability of that server, I'd use Packer or user data and an EIP for that instances. Only instances inside the VPC can talk to the VPC DNS dot 2 server. Private zones can mapped to more than VPC, so one VPC can do look ups for multiple zones, "You can associate a VPC with more than one private hosted zone, but the namespaces must not overlap. For example, you cannot associate a VPC with hosted zones for both example.com and acme.example.com because both namespaces end with example.com. " – strongjz Jan 15 '18 at 1:31
  • Can I use the dnsmasq/bind dns fowarder to forward to private instances in another VPC that's in another region using a private dns entry from route53 ? Tnx Tom – Tomislav Mikulin Jan 16 '18 at 14:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.