Restrict DNS queries on VPN network adapter to .local only

Question

I've got a Windows 10 PC which is connected to a VPN network which has a DNS server, is there anyway in Windows to only route DNS queries which have a .local suffix to the VPN, and have the rest of the traffic leave via the internet interface? The VPN does not force all traffic to go through it.

Answer 1

Yes, this is possible on Windows 7+ using the name resolution policy table. This allows you to set a different set of DNS servers for a given namespace. This is the table used by DirectAccess to direct some traffic over the DirectAccess tunnels.

Here are a couple example powershell commands you can used to manage the policy table and setup a policy for .local.

Add rule to send .local to over vpn

$Rule = @{
    'Namespace'   = '.local'
    'Comment'     = 'VPN network'
    'NameServers' = ('fdab:25f9:a362:58::2', 'fdab:25f9:a362:58::3')
}
Add-DnsClientNrptRule @Rule

Verify DNS resolution is working (nslookup will not use the policy table)

Resolve-DnsName 'example.local' -Type A_AAAA

Remove NRPT rules

Get-DnsClientNrptRule | Where { $_.Namespace -eq '.local' } | Remove-DnsClientNrptRule