I can’t seem to get Route53 to correctly forward DNS requests to nat64.net when using IPv6. The host in this case is Ubuntu 22 (though I think this is about AWS).

Here’s the background:

• I’ve created a Route53 Outbound Resolver with interfaces in an IPv6-only subnet. The “Resolver Endpoint Type” is “IPV6”.
• The security group associated to the interfaces allows all outbound and all inbound from within the VPC.
• I created a Resolver Rule to forward requests for ghcr.io to the three IPv6 addresses found on nat64.net
• The Resolver Rule is associated to the VPC.
• I can successfully query one of the IPv6 addresses on nat64.net from an IPv6-only EC2 instance within the same subnet as the Outbound Resolver endpoints. In other words, this works:

$ nslookup ghcr.io 2a01:4f9:c010:3f02::1
Server:     2a01:4f9:c010:3f02::1
Address:    2a01:4f9:c010:3f02::1#53

Non-authoritative answer:
Name:   ghcr.io
Address: 140.82.121.34
Name:   ghcr.io
Address: 2a01:4f9:c010:3f02:64:0:8c52:7922
Name:   ghcr.io
Address: 2a01:4f8:c2c:123f:64:5:8c52:7922
Name:   ghcr.io
Address: 2a00:1098:2b::1:8c52:7922

• This also works (showing DNS generally is fine within the VPC and that the subnet has Internet access via an IGW):

$ nslookup google.com
Server:     127.0.0.53
Address:    127.0.0.53#53

Non-authoritative answer:
Name:   google.com
Address: 142.251.211.238
Name:   google.com
Address: 2607:f8b0:400a:807::200e

• This does not work. I think this shows that the resolver rule is working but that the Outbound Resolver isn’t contacting the nat64.net addresses.

$ nslookup ghcr.io
;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out
;; no servers could be reached

• VPC flow logs don’t show any rejected connections

I have not (yet) found any documentation stating that Resolvers can’t use the Internet. I’d love to hear the community’s thoughts on this!