1

I have a home network that uses an internal subdomain of a domain that I own, int.example.com. The DNS servers on this network are a pair of Raspberry Pis running Pihole, which refer lookups for *.int.example.com to my router (which is still the DHCP server - the Piholes can't serve DHCP due to the physical topology of the network). Local DNS lookups work for all hosts as expected.

I work for a company that runs a corporate split-tunnel VPN (Cisco AnyConnect). I can't control the configuration of this VPN, other than the client setting to allow access to the local network (which I have set on, but which doesn't seem to have any effect if I disable it). The VPN client sets up an adapter with metric = 1. On my work laptop running Windows 11, this causes all DNS lookups to go through the VPN tunnel. So, a DNS lookup (via nslookup or through a browser) for a host on the internal network e.g. host.int.example.com will give no response, and nslookup will list the server as the corporate DNS server e.g. dns.example_company.com.

I modified the metric of the VPN adapter while it was connected so that it was higher than the metric of the laptop's LAN adapter (which defaults to 25). This flipped the situation so that the local network's DNS servers were used for all DNS lookups. However, it also made lookups fail for internal services on the corporate network e.g. internal_service.example_company.com will not be reachable. So this is a no-go for me.

Strangely, I can see (via Wireshark watching both interfaces simultaneously) that the DNS lookup for the local address goes out on both interfaces, and is answered with a valid IP address by the Piholes/local router, but this seems to be ignored as nslookup/the browser says the address could not be found. I can only assume (limited knowledge etc etc) that this is because the interface with the lower metric returned a null response, so that null response is preferred.

Is there a way to make Windows use DNS servers specific to a network suffix, from the Windows client side? So e.g. requests for *.int.example.com go to the Piholes on the local network (and thus to the router which can give a valid response), while requests for *.example_company.com will go to the DNS server supplied by the VPN tunnel. I understand that Cisco AnyConnect may have an administrator-controlled setting to do with split DNS but I can't control that, and the issue appears to be caused by the local computer's adapter metrics so I'm not confident that'd fix it anyway.

Note: I have dynamic DNS set up for the domain that I own, e.g. home.example.com, and I have tried to set up an NS record for int.example.com that points to home.example.com in the hope that this would make the VPN-connected laptop send DNS requests for *.int.example.com to home.example.com. A dig lookup sent explicitly to home.example.com from the VPN-connected laptop does work, I think the router routes it back to itself, but it doesn't work to send it through the default server i.e. dns.example_company.com doesn't give anything to the client which prompts a subsequent lookup to home.example.com. This was probably never going to work, but I had hope.

Improve this question
1
  • That does work, for individual static hosts, and in my case I'm not dealing with much else. My preference would be to use the DNS setup that I'm already running, for consistency with other computers on the network as well as simplicity. But it's a workaround I hadn't thought of, so thanks for that.
    – hartacus
    Commented Dec 14, 2022 at 5:37

1 Answer 1

Reset to default
1

You are trying to access local hosts while connected to a VPN that you do not manage. A number of measures are typically employed to control where you can and cannot go, what servers provide DNS etc.

You have shown yourself to be very resourceful, managing to thwart some of the VPN behaviors but the outcome has basically been that the VPN fails to function properly after your 'tweaks.' From the standpoint of the VPN (security), that is a very good thing.

Without management access to the VPN I don't see how you would succeed at convincing the VPN to allow you to use a 3rd party DNS server (whether yours or otherwise), nor to accept incoming traffic on behalf of one of your FQDN's.

Use the Windows HOSTS File

Your local traffic needs to be just that, local, then it will never reach the VPN. If you want to access local machines using FQDN's you should resolve the FQDN's to local IPs without querying a DNS server.

This can be done by simply adding a record for each hostname in your Windows HOSTS file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .