1

For some reason, our DNS resolution does not work correctly over SSTP VPN or S2S connection in azure.

Everything works fine directly in the Azure environment. Additionally, I get the correct DNS servers when establishing SSTP connection but the resolution does not work, DNS requests just time out.

So what has been tested so far:

  • configured P2S connection manually and forced the tunnel
  • appended connection specific suffixes

Any ideas, what I should look into?

PPP adapter test:

Connection-specific DNS Suffix . :  test.internal
Description . . . . . . . . . . . : test
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.10.4(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :

DNS Servers . . . . . . . . . . . : 168.63.129.16

NetBIOS over Tcpip. . . . . . . . : Enabled
0

Fresh VPN connections on Windows client machines do use a static routing metric, that sets your default gateway (= default route) to the VPN endpoint. While that is usually correct, in this case your DNS (168.) is on another network than your environment (10.). The 168.* is most probably not transparently reachable through your VPN gateway.

You can fix this on the gateway (and routing) side of your environment, or let the client decide what to do. I would simply disable the "set as default gateway" option in the newly created VPN adapter (Properties > IPv4 > Properties > Enhanced > Set as default gateway #off).

You can also do this with PowerShell:

Set-VpnConnection "CONNECTION NAME" -SplitTunneling $true

To add other networks to your VPN route, use the Add-VpnConnectionRoute CMDlet:

Add-VpnConnectionRoute -ConnectionName "CONNECTION NAME" -DestinationPrefix 10.42.42.0/24

Additionally, your client will then use it's own Internet connection for internet activities and no longer pu everythin on your VPN.

| improve this answer | |
  • 1
    Thanks for getting back, that's the case - by default split tunnel is enabled for connection, so I played around with different options.none of them works and that makes me confused. – VYG Mar 11 at 16:49
0

The IP address 168.63.129.16 is owned by MS. It's an Azure provided DNS server, in your scenario that Resolution of Azure hostnames from on-premises computers.

Forward queries to a customer-managed DNS proxy server in the corresponding virtual network, the proxy server forwards queries to Azure for resolution. See Name resolution using your own DNS server.

You could set up your DNS server in your Azure virtual network, after the VPN connection is updated, then download the VPN client packages.

For more information, you can view a similar thread.

| improve this answer | |
  • That's the case, I need to rely on Azure provided DNS... – VYG Mar 12 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.