Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a Windows Server 2008 R2 AD server that handles DNS for my network.

From the main LAN, DNS works fine. However, when you connect remotely from the VPN, DNS returns internal resources successfully, but external links (i.e. timeout.

Is there a setting I'm missing?

share|improve this question
Are the DNS search suffixes configured the same for LAN and VPN clients? – Shane Madden Jan 9 '12 at 19:47
It sounds like a routing issue rather than a name resolution issue to me. When connected to the VPN, what do you see if you run nslookup in interactive mode for How about when you run nslookup in debug mode? Can you post the results of both here? – joeqwerty Jan 10 '12 at 0:43
up vote 2 down vote accepted

It turned out to be an issue with the VPN Configuration on our ASA.

I had to remove the line:

split-dns <our domain>

which was causing the ASA to block requests to our internal DNS servers that were not for our domain. We aren't split tunneling, this must have been a remnant from when we were still using split-tunnel.


share|improve this answer

On the properties of your VPN connection on your workstation, ensure that the DNS servers are left blank. The VPN connection will inherit these properties (and things like DNS search suffixes) from the VPN server. That way your work station will use its DNS servers that it normally uses when not connected to the VPN to resolve external DNS queries, and yet still be able to resolve internal names too.

enter image description here

share|improve this answer
We use the Cisco VPN Client, so I'm not sure how this would translate to that version. What I don't understand though, is that the DNS Server will resolve external DNS entries for servers within the LAN, but won't for those on the VPN. I don't really care whose DNS servers our VPN users use, I just want them to resolve properly. – Dan R Jan 10 '12 at 15:05

when you do an nslookup on the vpn client, does the DNS return the correct record for internal and external resources? Its hard to tell if its a DNS or routing issue based on your description.

If nslookup returns the correct records (which it should) but you can only access internal resources, it's a routing issue. I'm guess in this same routing issue, you've probably configured your VPN client so that all network requests must tunnel through your internet connection, and that the VPN segment doesn't have access to internet eaither through an ACL or specific routing issue.

We use a split tunnle, which works well. Internal DNS server still provide name resolution, but traffic bound for the internal network goes over the VPN where as external traffic goes out the clients internet connection.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.