Can't resolve internal names over P2S,S2S in Azure

Question

For some reason, our DNS resolution does not work correctly over SSTP VPN or S2S connection in azure.

Everything works fine directly in the Azure environment. Additionally, I get the correct DNS servers when establishing SSTP connection but the resolution does not work, DNS requests just time out.

So what has been tested so far:

• configured P2S connection manually and forced the tunnel
• appended connection specific suffixes

Any ideas, what I should look into?

PPP adapter test:

Connection-specific DNS Suffix . :  test.internal
Description . . . . . . . . . . . : test
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.10.4(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :

DNS Servers . . . . . . . . . . . : 168.63.129.16

NetBIOS over Tcpip. . . . . . . . : Enabled

Answer 1

Fresh VPN connections on Windows client machines do use a static routing metric, that sets your default gateway (= default route) to the VPN endpoint. While that is usually correct, in this case your DNS (168.) is on another network than your environment (10.). The 168.* is most probably not transparently reachable through your VPN gateway.

You can fix this on the gateway (and routing) side of your environment, or let the client decide what to do. I would simply disable the "set as default gateway" option in the newly created VPN adapter (Properties > IPv4 > Properties > Enhanced > Set as default gateway #off).

You can also do this with PowerShell:

Set-VpnConnection "CONNECTION NAME" -SplitTunneling $true

To add other networks to your VPN route, use the Add-VpnConnectionRoute CMDlet:

Add-VpnConnectionRoute -ConnectionName "CONNECTION NAME" -DestinationPrefix 10.42.42.0/24

Additionally, your client will then use it's own Internet connection for internet activities and no longer pu everythin on your VPN.

Answer 2

The IP address 168.63.129.16 is owned by MS. It's an Azure provided DNS server, in your scenario that Resolution of Azure hostnames from on-premises computers.

Forward queries to a customer-managed DNS proxy server in the corresponding virtual network, the proxy server forwards queries to Azure for resolution. See Name resolution using your own DNS server.

You could set up your DNS server in your Azure virtual network, after the VPN connection is updated, then download the VPN client packages.

For more information, you can view a similar thread.