Reverse DNS for on-Premise domain not working

0

Target setup:

  • We have a /12 CIDR range assigned to AWS, e.g. 10.200.0.0/12
  • All other ranges from 10.0.0.0/8 belong to on-premise
  • We need to setup Reverse DNS and conditional forward, so that both, AWS and On-Prem, can do Reverse DNS lookups inside each location and cross location
  • I am not taking about Reverse DNS for Elastic IPs, but for all servers / resources in AWS (e.g. for Kerberos and others)
  • We followed guidance from this fantastic re:invent video: https://youtu.be/_Z5jAs2gvPA?t=1743

Issue 1 - RESOLVED:

  • FORWARD rules do not work for us
  • No matter what FORWARD rule I setup to On-Premise, it always resolve to the Hostname type of IP name ("[ip].eu-central-1.compute.internal")
  • This applies also when I set up the most specific FORWARD rule like 33.222.111.10.in-addr.arpa; normal FORWARD Rules like example.on-prem.com DO work Example: sh-5.2$ nslookup 10.111.222.33 33.222.111.10.in-addr.arpa name = ip-10-111-222-33.eu-central-1.compute.internal.
  • We would have expected name = hostname.example.on-prem.com.

Issue 2 - OPEN:

  • The number of FORWARD Rules seems to be A LOT when using a /12 for AWS
  • OPTION A: Having a PHZ for 200.10.in-addr.arpa. works for the 10.200.0.0/16, BUT that would require me to set up 16 PHZ for reverse DNS + a FORWARD Rule for 10.in-addr.arpa. to On-Prem
  • OPTION B: Having a PHZ for 10.in-addr.arpa. works for whole AWS environment, BUT that would require me to set up 240 FORWARD rules to On-PREM
  • Any guidance on this? https://www.ietf.org/rfc/rfc2317.txt only applies to <256 addresses

Unfortunately the documentation on FORWARD Rules on AWS is rather thin. Any hints for this setup / further read / any guidance? Thanks a lot in advance!

Andre
asked 16 days ago216 views
1 Answer
2
Accepted Answer

See this: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-automatic-forwarding-rules-reverse-dns.html

I believe you need to disable the automatic hostnames.

Hope this helps!

profile pictureAWS
EXPERT
iBehr
answered 16 days ago
profile picture
EXPERT
reviewed 13 days ago
profile picture
EXPERT
reviewed 14 days ago
  • Disabling automatic hostnames has the impact, that I cannot use any Private Hosted Zone in AWS anymore. This is mentioned in same documentation you linked. ("If you use custom DNS domain names defined in a private hosted zone in Amazon Route 53, or [...], you must set both the enableDnsHostnames and enableDnsSupport attributes to true.")

    However, your comment made me set this up, review all my config, and I found a typo in the FORWARD rules. FORWARD rules work now! A PHZ for PTR works too. So thanks a lot iBehr! Open is issue 2.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions