0

I have set up a VPN. I have a web app running on Apache and I changed configuration files only to allow connections from 10.8.0.0/24 subnet. My goal was to distinguish connection made from inside of VPN and from outside.

So I set up DNS inside my VPN. I wanted following behavior: When I'm connected to VPN and I enter app.domain.com into the browser, my private DNS will resolve domain name app.domain.com to private IP inside VPN e.g. 10.8.0.10. But when I'm not connected to VPN and I enter app.domain.com into the browser, my ISP's DNS will resolve domain name app.domain.com to public IP, e.g. 100.100.100.100. For VPN I use OpenVPN and I used configuration directive dhcp-option DNS 10.8.0.1 to push DNS to clients.

On my client computer (Windows 7) it works like a charm. When I'm connected to VPN, private DNS will resolve domain name to private IP. When I'm not connected to VPN, public DNS will resolve domain name to public IP. But on my friend's computer (again Windows 7) when he's connected to VPN he still gets public IP when he try to resolve domain name app.domain.com. I checked his ipconfig /all output, on his virtual VPN adapter is correctly set up private DNS 10.8.0.1.

So I wonder: Is there any DNS priority, so private DNS will be prioritized over public DNS ? Can I somehow attain behavior I mentioned earlier ?

Thank you for your answers

  • Similar question answered here: serverfault.com/questions/287803/… – blacklight Dec 30 '15 at 22:50
  • Also see this answer in regards to why this is usually a bad idea. The Q&A is focused on Active Directory but the bullets still mostly apply. Split DNS is one of those things that seems like a good idea in your early system administration years, and becomes something you hate as you're forced to work with it. – Andrew B Dec 31 '15 at 3:20
  • Did you check if friend's PC is making dns queries after the VPN comes up and not regurgitating cache? ipconfig /flushdns and restart browser? – Andrew Domaszek Dec 31 '15 at 6:41
0

Of corse there is, and has always been. Only that it's even more counter-intuitive in w7 than in XP.

Check the procedure here:

http://windows.microsoft.com/en-us/windows/change-network-protocol-bindings-order#1TC=windows-7

There's also tonns of answers involving the registry surgery, but why interfere with internals if there's a standard way, right ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.