Hello,
I have my root domain (rsubr.in) hosted with CloudFlare and working great.
I have a private subdomain (int.rsubr.in) in AWS VPC Route53. This is not public and visible only within the VPC.
In CloudFlare I want to delegate int.rsubr.in to the internal Route53 resolver so users can lookup internal hosts even when they are using public DNS servers.
This is necessary as some VPN clients who connect to the VPC do not get correct DNS settings and end up using public 8.8.8.8 DNS. int.rsub.in name resolution fails and users are unable to access VPC hosts via VPN.
My plan is to configure CloudFlare to delegate int.rsubr.in to the internal Route53 resolver IP (172.31.0.2), then VPN users can resolve internal hosts regardless of the DNS they are using.
I followed the steps described here: https://malware.expert/howto/delegate-subdomain-cloudflare-to-other-dns-servers/ but I’m unable to get it working.
In CloudFlare for rsubr.in, I have created these 2 records:
- A record for nsint.example.com with value 172.31.0.2 (glue)
- NS record for int.example.com pointing to nsint.example.com
AWS Route53 setup:
[email protected]:~$ dig -t ns rsubr.in
; <<>> DiG 9.10.3-P4-Ubuntu <<>> -t ns rsubr.in
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62841
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;rsubr.in. IN NS
;; ANSWER SECTION:
rsubr.in. 21599 IN NS art.ns.cloudflare.com.
rsubr.in. 21599 IN NS vera.ns.cloudflare.com.
;; Query time: 419 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Nov 15 18:30:57 DST 2017
;; MSG SIZE rcvd: 91
[email protected]:~$ dig -t ns int.rsubr.in
; <<>> DiG 9.10.3-P4-Ubuntu <<>> -t ns int.rsubr.in
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 1972
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;int.rsubr.in. IN NS
;; Query time: 74 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Nov 15 18:31:02 DST 2017
;; MSG SIZE rcvd: 41
I am also unable to resolve any A records (*.int.rsubr.in) in my subdomain.
Any help is much appreciated!