Reverse DNS for on-Premise domain not working

0

Target setup:

  • We have a /12 CIDR range assigned to AWS, e.g. 10.200.0.0/12
  • All other ranges from 10.0.0.0/8 belong to on-premise
  • We need to setup Reverse DNS and conditional forward, so that both, AWS and On-Prem, can do Reverse DNS lookups inside each location and cross location
  • I am not taking about Reverse DNS for Elastic IPs, but for all servers / resources in AWS (e.g. for Kerberos and others)
  • We followed guidance from this fantastic re:invent video: https://youtu.be/_Z5jAs2gvPA?t=1743

Issue 1 - RESOLVED:

  • FORWARD rules do not work for us
  • No matter what FORWARD rule I setup to On-Premise, it always resolve to the Hostname type of IP name ("[ip].eu-central-1.compute.internal")
  • This applies also when I set up the most specific FORWARD rule like 33.222.111.10.in-addr.arpa; normal FORWARD Rules like example.on-prem.com DO work Example: sh-5.2$ nslookup 10.111.222.33 33.222.111.10.in-addr.arpa name = ip-10-111-222-33.eu-central-1.compute.internal.
  • We would have expected name = hostname.example.on-prem.com.

Issue 2 - OPEN:

  • The number of FORWARD Rules seems to be A LOT when using a /12 for AWS
  • OPTION A: Having a PHZ for 200.10.in-addr.arpa. works for the 10.200.0.0/16, BUT that would require me to set up 16 PHZ for reverse DNS + a FORWARD Rule for 10.in-addr.arpa. to On-Prem
  • OPTION B: Having a PHZ for 10.in-addr.arpa. works for whole AWS environment, BUT that would require me to set up 240 FORWARD rules to On-PREM
  • Any guidance on this? https://www.ietf.org/rfc/rfc2317.txt only applies to <256 addresses

Unfortunately the documentation on FORWARD Rules on AWS is rather thin. Any hints for this setup / further read / any guidance? Thanks a lot in advance!

Andre
asked 21 days ago220 views
1 Answer
2
Accepted Answer

See this: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-automatic-forwarding-rules-reverse-dns.html

I believe you need to disable the automatic hostnames.

Hope this helps!

profile pictureAWS
EXPERT
iBehr
answered 21 days ago
profile picture
EXPERT
reviewed 18 days ago
profile picture
EXPERT
A_J
reviewed 19 days ago
  • Disabling automatic hostnames has the impact, that I cannot use any Private Hosted Zone in AWS anymore. This is mentioned in same documentation you linked. ("If you use custom DNS domain names defined in a private hosted zone in Amazon Route 53, or [...], you must set both the enableDnsHostnames and enableDnsSupport attributes to true.")

    However, your comment made me set this up, review all my config, and I found a typo in the FORWARD rules. FORWARD rules work now! A PHZ for PTR works too. So thanks a lot iBehr! Open is issue 2.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions