Skip to main content

01 · Split-horizon DNS across 3 sites over a Tailscale mesh

Architecture · Private DNS resolution

Three VPC + IDC site pairs, each owning a private Route 53 hosted zone for the same domain corp.internal. Local Unbound resolvers forward the zone over Tailscale, so the same FQDN returns a different, site-local record in each zone. · 3 × VPC · 3 × IDC · 3 × private zone · 2 × server / zone · interactive original ↗

note

Names and addresses in this section are placeholders — 3 VPC · 3 IDC · Tailscale full mesh · private Route 53 zones · Unbound forwarders.

VPC / cloudIDC / on-premRoute 53 Resolver + PHZcorp.internalUnbound resolverforward-zoneTailscale tunnel (WireGuard) A ↔ BA ↔ CB ↔ Ctailnet · corp-meshfull mesh · direct P2P WireGuardSITE Aap-northeast-1 ⇄ OfficeZone AVPC10.1.0.0/16Route 53 Resolverinbound endpoint · 2 IPs10.1.0.10 · 10.1.1.10Private Hosted Zonecorp.internalIDC10.10.0.0/16Unbound × 2 (HA)ns1 10.10.0.2ns2 10.10.0.3Clients → :53forward-zone corp.internal → Route 53 EP, over TailscaleSITE Bap-northeast-1 ⇄ TaichungZone BVPC10.2.0.0/16Route 53 Resolverinbound endpoint · 2 IPs10.2.0.10 · 10.2.1.10Private Hosted Zonecorp.internalIDC10.20.0.0/16Unbound × 2 (HA)ns1 10.20.0.2ns2 10.20.0.3Clients → :53forward-zone corp.internal → Route 53 EP, over TailscaleSITE Cap-northeast-1 ⇄ TaipeiZone CVPC10.3.0.0/16Route 53 Resolverinbound endpoint · 2 IPs10.3.0.10 · 10.3.1.10Private Hosted Zonecorp.internalIDC10.30.0.0/16Unbound × 2 (HA)ns1 10.30.0.2ns2 10.30.0.3Clients → :53forward-zone corp.internal → Route 53 EP, over Tailscale

Tailnet​

tailnet · corp-mesh — full mesh · direct P2P WireGuard: A ↔ B · A ↔ C · B ↔ C.

Sites​

Site A — ap-northeast-1 ⇄ Office · Zone A​

VPC10.1.0.0/16
Route 53 Resolverinbound endpoint · 2 IPs — 10.1.0.10 · 10.1.1.10
Private Hosted Zonecorp.internal
IDC10.10.0.0/16
Unbound × 2 (HA)ns1 10.10.0.2 · ns2 10.10.0.3
Clients→ :53

forward-zone corp.internal → Route 53 EP, over Tailscale

Site B — ap-northeast-1 ⇄ Taichung · Zone B​

VPC10.2.0.0/16
Route 53 Resolverinbound endpoint · 2 IPs — 10.2.0.10 · 10.2.1.10
Private Hosted Zonecorp.internal
IDC10.20.0.0/16
Unbound × 2 (HA)ns1 10.20.0.2 · ns2 10.20.0.3
Clients→ :53

forward-zone corp.internal → Route 53 EP, over Tailscale

Site C — ap-northeast-1 ⇄ Taipei · Zone C​

VPC10.3.0.0/16
Route 53 Resolverinbound endpoint · 2 IPs — 10.3.0.10 · 10.3.1.10
Private Hosted Zonecorp.internal
IDC10.30.0.0/16
Unbound × 2 (HA)ns1 10.30.0.2 · ns2 10.30.0.3
Clients→ :53

forward-zone corp.internal → Route 53 EP, over Tailscale