Please note that this question is different than this one here where they used a standard AMI vs NAT AMI (in my case). Also in my case private instance can access Internet via ipaddress but not via hostname resolution.

Here's my setup:

  • Non-default VPC with 1 public subnet & 1 private subnet.
  • NAT instance on the public subnet with an elastic IP. Used Amazon Community NAT AMI: amzn-ami-vpc-nat-hvm-2017.09.1.20180108-x86_64-ebs ami-d4a883b1. Amazon Linux AMI 2017.09.1.20180108 x86_64 VPC NAT HVM EBS
  • Security group as per NAT Security Group documentation attached to NAT instance above
  • Private instance (on private subnet) can reach Internet via NAT instance as long as it uses ip address. For example: curl http://74.125.135.99/ works but curl http://www.google.com doesn't work

Private instance:

$cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.0.1
search us-east-2.compute.internal

$ curl http://74.125.135.99/
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>

$ curl http://www.google.com/
curl: (6) Could not resolve host: www.google.com

NAT instance:

$ cat /etc/resolv.conf
; generated by /sbin/dhclient-script
search us-east-2.compute.internal
options timeout:2 attempts:5
nameserver 10.0.0.2

UPDATE: Following DNS settings are on my VPC:

DNS resolution: yes
DNS hostnames: yes

DNS resolution in a VPC does not depend on the NAT device, whether it's a NAT instance or NAT Gateway, and because of the way it's implemented, it is very difficult if not impossible to break DNS through misconfiguration of the network, because the traffic has no need to be allowed via security groups and Network ACLs.

If it isn't working, that suggests it's not turned on.

Ensure that enableDnsSupport is set to true.

https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html#vpc-dns-support

You'll probably want to activate enableDnsHostnames while you're there. It does not make your instances "public," despite the fact that the documented description implies that it does.

There is rarely a case for not enabling either of these options.

  • On my VPC the following is set. Is this what you are referring to? DNS resolution: yes DNS hostnames: yes – mpprdev Jan 15 at 5:55
  • Yes... but I just noticed nameserver 127.0.0.1 on your instance. Any idea how that got that way? It should be the same as the NAT machine. They should all be the same, it should be the base address of your VPC + 2 (e.g. 10.0.0.0/x >> 10.0.0.2). – Michael - sqlbot Jan 15 at 6:27
  • No idea how it was set - it was set automatically. I rebooted and the values stayed the same. – mpprdev Jan 15 at 6:36
  • 1
    Check your DHCP Options Sets. – Michael - sqlbot Jan 15 at 7:17
  • 2
    I'm glad you found it, @mpprdev. If for some reason you wanted to use dnsmasq, it should work if you configure it to use 169.254.169.253 as its upstream server. That's a special address, functionally equivalent to the x.x.x.2 address for the DNS resolver in your VPC, but portable across different VPCs so it's safe to hard-code. – Michael - sqlbot Jan 16 at 0:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.