I've got a Windows 10 PC which is connected to a VPN network which has a DNS server, is there anyway in Windows to only route DNS queries which have a .local suffix to the VPN, and have the rest of the traffic leave via the internet interface? The VPN does not force all traffic to go through it.
1 Answer
Yes, this is possible on Windows 7+ using the name resolution policy table. This allows you to set a different set of DNS servers for a given namespace. This is the table used by DirectAccess to direct some traffic over the DirectAccess tunnels.
Here are a couple example powershell commands you can used to manage the policy table and setup a policy for .local
.
Add rule to send .local to over vpn
$Rule = @{
'Namespace' = '.local'
'Comment' = 'VPN network'
'NameServers' = ('fdab:25f9:a362:58::2', 'fdab:25f9:a362:58::3')
}
Add-DnsClientNrptRule @Rule
Verify DNS resolution is working (nslookup will not use the policy table)
Resolve-DnsName 'example.local' -Type A_AAAA
Remove NRPT rules
Get-DnsClientNrptRule | Where { $_.Namespace -eq '.local' } | Remove-DnsClientNrptRule