Please note that this question is different than this one here where they used a standard AMI vs NAT AMI (in my case). Also in my case private instance can access Internet via ipaddress but not via hostname resolution.

Here's my setup:

  • Non-default VPC with 1 public subnet & 1 private subnet.
  • NAT instance on the public subnet with an elastic IP. Used Amazon Community NAT AMI: amzn-ami-vpc-nat-hvm-2017.09.1.20180108-x86_64-ebs ami-d4a883b1. Amazon Linux AMI 2017.09.1.20180108 x86_64 VPC NAT HVM EBS
  • Security group as per NAT Security Group documentation attached to NAT instance above
  • Private instance (on private subnet) can reach Internet via NAT instance as long as it uses ip address. For example: curl works but curl http://www.google.com doesn't work

Private instance:

$cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
search us-east-2.compute.internal

$ curl
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.

$ curl http://www.google.com/
curl: (6) Could not resolve host: www.google.com

NAT instance:

$ cat /etc/resolv.conf
; generated by /sbin/dhclient-script
search us-east-2.compute.internal
options timeout:2 attempts:5

UPDATE: Following DNS settings are on my VPC:

DNS resolution: yes
DNS hostnames: yes

DNS resolution in a VPC does not depend on the NAT device, whether it's a NAT instance or NAT Gateway, and because of the way it's implemented, it is very difficult if not impossible to break DNS through misconfiguration of the network, because the traffic has no need to be allowed via security groups and Network ACLs.

If it isn't working, that suggests it's not turned on.

Ensure that enableDnsSupport is set to true.


You'll probably want to activate enableDnsHostnames while you're there. It does not make your instances "public," despite the fact that the documented description implies that it does.

There is rarely a case for not enabling either of these options.

| improve this answer | |
  • On my VPC the following is set. Is this what you are referring to? DNS resolution: yes DNS hostnames: yes – mpprdev Jan 15 '18 at 5:55
  • Yes... but I just noticed nameserver on your instance. Any idea how that got that way? It should be the same as the NAT machine. They should all be the same, it should be the base address of your VPC + 2 (e.g. >> – Michael - sqlbot Jan 15 '18 at 6:27
  • No idea how it was set - it was set automatically. I rebooted and the values stayed the same. – mpprdev Jan 15 '18 at 6:36
  • 2
    Check your DHCP Options Sets. – Michael - sqlbot Jan 15 '18 at 7:17
  • 3
    I'm glad you found it, @mpprdev. If for some reason you wanted to use dnsmasq, it should work if you configure it to use as its upstream server. That's a special address, functionally equivalent to the x.x.x.2 address for the DNS resolver in your VPC, but portable across different VPCs so it's safe to hard-code. – Michael - sqlbot Jan 16 '18 at 0:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.