DNS Server Order Incorrect on Windows 7 via PPTP VPN to Windows 2003 Server

Question

When I connect a Windows XP laptop via PPTP vpn to our Windows 2003 Server, the DNS Server order is correct:

192.168.8.3
208.67.222.222
208.67.220.220

But when I connect a Windows 7 laptop via PPTP VPN to our Windows 2003 Server, the DNS order is incorrect:

208.67.222.222
208.67.220.220
192.168.8.3

What do I need to do on our Windows 2003 Server to fix this so the when I do a ping, it will work correctly?

Answer 1

Multiple DNS servers are usually provided for the case of redundancy, not for "chaining" requests. If you want to do that, there's a much more efficient solution.

208.67.x.x - I assume these are your ISP's DNS severs? If you want to query these only if a request to 192.168.8.3 does not resolve to anything, then you can do this with a DNS Forwarder, but even better is to skip it alltogether an use Root Hints in your DNS server (so that it gets its own DNS records, rather than proxying them through another DNS).

However, for this example, I'm going to assume you want to continue to use a DNS forwarder, for whatever reasons, and that your DNS server is also a Windows 2003 machine (credit to http://www.petri.co.il/install_and_configure_windows_2003_dns_server.htm):

1. Click Start, point to Programs, point to Administrative Tools, and then click DNS to start the DNS Management Console.
2. Right click the DNS Server object for your server in the left pane of the console, and click Properties.
3. Click the Forwarders tab.
4. Check the Enable forwarders check-box.
5. In the IP address box enter the IP address of the DNS servers you want to forward queries to - typically the DNS server of your ISP. You can also move them up or down. The one that is highest in the list gets the first try, and if it does not respond within a given time limit - the query will be forwarded to the next server in the list.
6. Click OK.

This way you only need to have a single DNS entry for the PPTP connections, but the end result is the same.

Answer 2

I'm assuming that when connected to the VPN from Windows 7 that you're unable to resolve internal resources because of the order that the DNS servers are listed. The way DNS server settings are applied to a VPN client are as follows: If the VPN server is configured to allocate ip addresses to the VPN client from an internal DHCP server then the client will receive the DNS servers that are configured in the DHCP scope that the VPN client gets it's ip address from. If the VPN server is configured to allocate ip addresses to the VPN client from a static pool then the VPN client will receive the DNS servers that the VPN server is configured to use (from the TCP\IP properties of the VPN server itself).

My suggestion would be to verify the DNS servers configured on the VPN server and in the DHCP scope and make sure they're correct.

Also, in addition to what Farseeker has posted I would also recommend using root hints instead of forwarders on your internal DNS server. All of your internal hosts (including the DNS server) should be configured to use the internal DNS server only. The DNS server should be configured to use itself for DNS and the DNS service should be configured to use root hints (or forwarders if you choose) for external (non-authoritative) resolution.

Answer 3

Problem - When connected to a VPN using Windows 7 my DNS resolution uses the remote network's DNS servers not my local DNS servers; I then gradually lose connection to local resources including Exchange, File shares, DFS etc..

What I do is for any PPTP connections is I set "OBTAIN IP ADDRESS AUTOMATICALLY" as normal, BUT I MANUALLY define the DNS Servers to be my local one(s). THis way all DNS resolution is via my own DNS servers and not the VPN ones. My local LAN resources are all still available and active even with a few VPN connections up.

The only issue is I cannot resolve VPN-related hostnames, but that is rearely an issue as I tend to use IP addresses for remote RDP/VNC etc

Answer 4

For what it's worth, this does appear to be a fault in Windows 7. I've seen the exact same problem with a Windows SBS 2003 server -- the only Windows 7 machine connected to it via PPTP, was assigning itself the DNS servers in reverse order, meaning that the machine could not find any resources on the remote network, as the ISP's DNS servers were being asked first, and they were rejecting .local addresses.

I'm now seeing the same thing on a Windows 7 laptop connecting to a ZyXEL VPN (P-661HW-D1 connecting to a ZyWALL 5), where the VPN-specific DNS IP address is being listed second. Here, the ZyXEL hardware is responsible for DHCP. Again, this prevents the machine functioning on the VPN as the first DNS entry (default gateway) is rejecting local addresses.

I can't say whether or not Vista was affected, but certainly something is wrong with the way Windows 7 does DNS as this fault did not occur in XP.

Answer 5

I have seen this same problem on XP machines and it was solved by this:

http://support.microsoft.com/default.aspx?scid=kb;en-us;311218

However it did not work on my Win7 machine; I ended up creating an entry in the HOSTS file - not the best soliution by a mile but it got my client up and running.