DNS not working on UTM 9 on AWS

Question

Hello, 
 
 I have setup UTM 9 appliance on my AWS VPC with SSL remote access. VPN access is working fine but my AWS DNS times out when i connect over vpn. It does show the AWS DNS but it does not resolve anything. I have already added the AWS DNS Remote Access >> Advanced >> DNS Server 10.3.0.2 and other options as well but i get timeout when connected over VPN following , i have exact same UTM configured this way and its works fine. 
 
 C:\Users\vneb>nslookup DNS request timed out. timeout was 2 seconds. Default Server: UnKnown Address: 10.3.0.2 
 
 can anyone suggest what could be wrong , i m fine to give more info as required.

BAlfson · Accepted Answer

NAT #1 will have no effect and nothing like it is necessary. 
 NAT #2 is what you want, but with a source translation of " External (Address)." Instead of this SNAT, you could use a Masquerading rule: VPN Pool (SSL) -> External. 
 Firewall rules #2 and #4 will have no effect and can be deleted. If you selected 'Automatic firewall rules' in the SSL VPN Profile, #6 is redundant, otherwise, it's just what you need. 
 If you still aren't getting the result you want, insert pictures of "Remote Access >> Advanced" and of 'Allowed Networks' in 'Network Services >> DNS'. 
 Cheers - Bob

Emile Belcourt · Answer

Hi Vibhor, 
 Create a NAT rule under Network Protection > NAT > NAT tab that SNATs the SSL VPN Pool to the AWS interface IP of the UTM. My limited understanding of AWS is that there are a whole raft of routing tables on the AWS virtual switch which means that unless you've configured those, they route off into the ether. 
 So your SNAT rule would look like this: 
 
 Source: SSL VPN Pool 
 Service: Any 
 Destination: Any IPV4 
 Change Source to: Interface IP of UTM 
 Automatic Firewall rule: Yes 
 
 Because the AWS switch knows where the UTM is, but not where your SSL VPN pool is so then the routing will go back to the UTM. Whereas currently what's happening is your traffic is going onto the AWS switch but the return traffic goes down the default gateway path which is not the UTM. 
 I did that for my AWS UTM and it was all good, hope that works for you too! 
 Emile