DEV Community

Ashish Nair
Ashish Nair

Posted on

I Built Hybrid DNS Between AWS and My On-Prem Linux Server -- Here's What Finally Made Route 53 Resolver Click

#aws #dns #devops

Why I built this?

I wanted to actually build a hybrid DNS environment and see the DNS queries travel between an on-premises environment and AWS.

My lab ended up having two separate DNS requirements:

  • A public DNS name for my application: app.xcv.publicvm.com
  • A private DNS namespace inside AWS: aws.internal

These are the 2 hosted zones I created in Route53:

The interesting part was making my on-premises Linux DNS server — which is also my MariaDB server at 192.168.1.10 — resolve a private AWS RDS name: rds.aws.internal.

The Architecture

The DNS pieces and why they exist:

1.Public DNS - app.xcv.publicvm.com
In my Public hosted zone I created failover routing with 2 A records:
app.xcv.publicvm.com
- primary -> 13.206.252.123
- failover -> 13.233.70.186
This is the also the DNS record that my application lives on.

2.Private DNS - aws.internal
I created a private hosted zone: aws.internal. This zone isn't resolvable publicly. This simply has a CNAME that points to my RDS' endpoint.

3. On-premise DNS - onprem.example.com
My on-premises environment has a Linux server at 192.168.1.10. This is also my mariadb server (which is ofcourse not a good practice but laziness 😁)

Now, we have 2 DNS authorities:

  1. On prem - onprem.example.com
  2. Route53 - aws.internal

And the good part is neither needs to become authoritative for the other environment (Because my DNS is not greedy like humans 😁). Instead, we forward queries.

Now, The problem!
There has to be a problem for us to provide a solution! Imagine, an application that sits on-premise wants to resolve rds.aws.internal -> 192.168.1.10(A.K.A on-premise DNS) . This fails. Because our on-premise isn't authoritative for aws.internal(It's a private hosted zone on AWS).

You can beat me up and say - "Add a static record on the On-premise DNS server".
I'd say hold my beer, this is why my setup exists:

  • Adding a static entry is not a good hybrid architecture practice.
  • RDS is owned by AWS, what if it changes the IP?
  • And lastly, I'd say meet our friend - Route53 resolver Inbound Endpoint.

what is a Route53 resolver Inbound Endpoint ?
An Inbound Resolver Endpoint is used when DNS queries are coming into AWS from an external network(External is our on-premise network).

The flow (Roughly!) is:

The benefit : our on-prem DNS doesn't need to know how AWS works the magic! It just forwards anything *.aws.internal to the resolver.

And this is the validation that it worked:

Top comments (0)