0

DNS queries to hosts accessible through a VPN fail. How to fix?

On a Windows 10 host, DNS queries for hosts known only to the VPN-accessible DNS Server fail to resolve. The DNS queries are sent to my local DNS Server (192.168.1.1) which returns no DNS Answers. DNS queries are not sent to the VPN-accessible DNS Server (10.0.1.1).

Powershell Get-DnsClientServerAddress shows:

PS> Get-DnsClientServerAddress
InterfaceAlias               Interface Address ServerAddresses
                             Index     Family
--------------               --------- ------- ---------------
Ethernet                            10 IPv4    {192.168.1.1}
Ethernet                            10 IPv6    {}
VPN                                 20 IPv4    {10.0.1.1}
VPN                                 20 IPv6    {}

Pinging the VPN DNS Server succeeds (ping 10.0.1.1).
Resolving a DNS name of google.com succeeds (Resolve-DnsName google.com).
However, resolving a DNS name of VPN-accessible host server.corp.com fails.

PS> Resolve-DNSName server.corp.com
PS>

How can I force DNS queries to prefer the VPN-accessible DNS Server at 10.0.1.1?

0

Change the InterfaceMetric for the VPN interface to be lower in value (more important) than the local Ethernet interface.

Using Get-NetIPInterface, the interface metrics were

PS> Get-NetIPInterface
ifIndex InterfaceAlias AddressFamily NlMtu(Bytes) InterfaceMetric Dhcp     ConnectionState PolicyStore
------- -------------- ------------- ------------ --------------- ----     --------------- -----------
10      Ethernet       IPv6                  1500              35 Enabled  Connected       ActiveStore
10      Ethernet       IPv4                  1500            4000 Enabled  Connected       ActiveStore
20      VPN            IPv4                  1400              35 Disabled Connected       ActiveStore

(yes, it is odd that the Ethernet interface has AddressFamily IPv4 high integer value 4000 for InterfaceMetric, has AddressFamily IPv6 low integer value 35 for InterfaceMetric yet no IPv6 Address is assigned to the interface)

Using Set-NetIPInterface I changed the VPN interface property InterfaceMetric to lower integer value 15 for AddressFamily IPv4 (requires Administrator permissions)

PS> Set-NetIPIinterface -InterfaceIndex 20 -InterfaceMetric 15

Now the DNS queries for hosts known to the VPN-accessible DNS Server succeed.

PS> Resolve-DNSName server.corp.com
Name                  Type   TTL   Section    IPAddress
----                  ----   ---   -------    ---------
server.corp.com       A      130   Answer     10.0.1.2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.