Private DNS Server

Log in to the AWS console.
Select your VPC and then
DHCP option sets
.
You can create a new DHCP option set and add your DNS server IP address. In this example, 172.18.10.1 is the private DNS server address. If you have an existing DHCP option set with your DNS server configured, view the details and take note of the DNS server IP address.

Select
VPC
and choose the VPC to secure.
From the
Actions
drop-down, select
Edit VPC settings
.
Under
DHCP settings
, choose the DHCP option set with your private DNS server configured from the
DHCP option set
drop-down.
Click
Save changes
.
The selected VPC now directs all DNS queries to the configured DNS server.
Edit your subnet route table.
Select
VPC
Route tables
.
Select the route table for the subnet you want to secure.
Add a route and set the destination to the IP address of your DNS server.

Click
Save changes.
Any DNS traffic from the protected subnet is routed through the Cloud NGFW endpoint and on to the Cloud NGFW for inspection and enforcement.