WireGuard With AWS Split DNS

The first thing to do is make sure your VPC is configured for DNS resolution. This will enable you to use the DNS nameserver built into the VPC, not only for EC2 hosts within VPC, but also for WireGuard clients connected to the WireGuard server running in the VPC.

So log into the AWS Console, and navigate to the VPC service (type vpc into the AWS search bar and click the “VPC” result under “Services”). In the leftnav, click the Your VPCs link to see the list of your VPCs in the current region:

Then select the VPC with your WireGuard server running in it (in this example, vpc-sandbox-0976-2022-01-07), and view its details, looking particularly at the DNS resolution setting:

This setting is Enabled by default; but if has been disabled, re-enable it by selecting the Edit DNS resolution action from the Actions menu:

Next, create a Route 53 private hosted zone. Unlike a normal public zone, this zone won’t be available to the public recursive nameservers you use for public DNS names (like the 8.8.8.8 nameserver Google provides, or the 1.1.1.1 nameserver from Cloudflare, or the nameservers provided by your ISP). It will only be available to the nameserver running in your VPC.

Start by navigating to the Route 53 service (type route 53 into the AWS search bar and click the “Route 53” result under “Services”). In the leftnav, click the Hosted zones link to see the list of your hosted zones:

Then click the Create hosted zone button to create a new hosted zone:

Next, enter the internal subdomain you’ll use for your internal AWS resources in the Domain field; in this example, I’ll use internal.example.com, but you can use literally any domain name you want (like tools.corp or my-vpc.us-west-2.private.example.net, etc). Then for Type, select Private hosted zone:

Scroll down, and select the Region and VPC ID of the VPC with your WireGuard server running in it (in this example, I’m using us-west-2 and vpc-0ae7d8517dfc6b56e for my VPC). Then click the Create hosted zone button:

Now create a DNS record for the internal web app instance you launched in the original WireGuard With AWS tutorial (and create additional records for each other internal resources you want to be able to access via domain name).

On the main page for the hosted zone you just created, click the Create record button:

Then enter the DNS name to use for the internal app in the Record name field (for this example, I’ll use the imaginative and exciting name of application.internal.example.com). Make sure the Record type is A (the default, for an IPv4 address), and enter the internal IPv4 address of the internal app in the Value field (10.10.21.130 in this example).

Finally, click the Create records button:

The IPv4 address of the DNS nameserver running in the VPC will be the base of the IPv4 CIDR block used by the VPC, plus 2. In this example, where the VPC uses the 10.10.0.0/16 CIDR block, the DNS nameserver’s address is 10.10.0.2. If the VPC’s IPv4 CIDR block was instead 192.168.123.64/26, the DNS nameserver’s address would be 192.168.123.66. You do not need to configure any Network ACLs or Security Groups to access it — it is always accessible by any host in the VPC, from any subnet in the VPC.

So, unless you’re using systemd on Linux, update your WireGuard client config to add a DNS setting like the following, to the [Interface] section of the config file:

This will add 10.10.0.2 to the list of DNS nameservers your workstation queries when the WireGuard interface is up. Make sure the AllowedIPs setting in the [Peer] section includes this IP address in its list of allowed IP addresses and blocks (in this example, AllowedIPs = 10.10.0.0/16, and 10.10.0.2 is in 10.10.0.0/16; but if we had instead done something like set AllowedIPs = 10.10.21.0/24, we’d need to add 10.10.0.2 explicitly to it, like AllowedIPs = 10.10.21.0/24, 10.10.0.2).

You may also want to add the subdomain internal.example.com (or whatever subdomain you configured for the Create a Private Hosted Zone step above) to this same DNS setting, if you want internal.example.com added to your DNS search domains when the WireGuard interface is up, like so:

This will configure your local workstation to try appending .internal.example.com to any unqualified hostnames you try to resolve (for example, to try to resolve application as application.internal.example.com).

In the original WireGuard With AWS tutorial, we started up a dummy webserver for the internal application at 10.10.21.130 on port 8080, and connected to it from our local workstation with the following command:

But if you set up the application.internal.example.com domain name to point to 10.10.21.130 in the Add a DNS Record for the Web App step above, you can now access that same internal app by domain name:

And if you configured internal.example.com as a search domain in the Configure DNS on the WireGuard Client step above, you can also access that same internal app just by using the hostname part of the fully-qualified domain name:

If you see an error from cURL like Could not resolve host: application.internal.example.com, try using the dig or nslookup command both on your local workstation and on the WireGuard server, and compare the results.