Client not usig pushed DNS server

gavinsbtm

Hi

I'm having a lot of trouble trying to get a windows 10 client machine to pass all DNS queries through the VPN tunnel.

Even though I push a DNS server address to the client and ipconfig /all shows the correct DNS IP address

nslookup results in:

C:\Windows\system32>nslookup alpha.intranet.lan
Server:  UnKnown
Address:  172.20.10.1

*** UnKnown can't find alpha.intranet.lan: Non-existent domain

Forcing nslookup to pass the query to the DNS server I am trying to use results in:

C:\Windows\system32>nslookup alpha.intranet.lan 10.0.0.1
Server:  lan.router
Address:  10.0.0.1

Non-authoritative answer:
Name:    alpha.intranet.lan
Address:  10.0.0.251

Ethernet adapter Ethernet 3:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Apple Mobile Device Ethernet
   Physical Address. . . . . . . . . : 9A-B8-E3-EE-60-5A
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 172.20.10.2(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.240
   Lease Obtained. . . . . . . . . . : 03 September 2015 09:55:58
   Lease Expires . . . . . . . . . . : 04 September 2015 12:01:18
   Default Gateway . . . . . . . . . : 172.20.10.1
   DHCP Server . . . . . . . . . . . : 172.20.10.1
   DNS Servers . . . . . . . . . . . : 172.20.10.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet 2:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Win32 Adapter V9
   Physical Address. . . . . . . . . : 00-FF-ED-14-C5-07
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.8.0.4(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : 03 September 2015 11:25:46
   Lease Expires . . . . . . . . . . : 02 September 2016 11:25:45
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 10.8.0.254
   DNS Servers . . . . . . . . . . . : 10.0.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      172.20.10.1      172.20.10.2     20
          0.0.0.0        128.0.0.0         10.8.0.1         10.8.0.4     31
         10.0.0.0    255.255.255.0         10.8.0.1         10.8.0.4     31
         10.8.0.0    255.255.255.0         On-link          10.8.0.4    286
         10.8.0.4  255.255.255.255         On-link          10.8.0.4    286
       10.8.0.255  255.255.255.255         On-link          10.8.0.4    286
   **.***.***.***  255.255.255.255      172.20.10.1      172.20.10.2     21  <-- Public VPN address
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.1         10.8.0.4     31
      172.20.10.0  255.255.255.240         On-link       172.20.10.2    276
      172.20.10.2  255.255.255.255         On-link       172.20.10.2    276
     172.20.10.15  255.255.255.255         On-link       172.20.10.2    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.8.0.4    286
        224.0.0.0        240.0.0.0         On-link       172.20.10.2    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.8.0.4    286
  255.255.255.255  255.255.255.255         On-link       172.20.10.2    276
===========================================================================

horihel

This is a typical problem with windows 10: Windows 10 by default asks every configured DNS server and will take the first answer that it gets. Usually the local DNS servers in your local net can reply faster than the DNS server that is on the other side of the VPN tunnel. And if the local DNS returns NXDOMAIN (not found) then windows will take this as truth and discard the answer coming from the VPN tunnel.

Unfortunately while this behaviour was configurable on Windows 8.x, it doesn'T seem to be on 10.

The only workaround I'm aware of is actually deconfiguring every DNS server except the one on the tunnel device.

I'd be happy if someone can come up with a better solution or script. For us this means openvpn cannot work with windows 10 at the moment at least if you want DNS queries to work.

Traffic

@ horihel

Thank you for your reply. This is much to be expected from Micro$oft.
It appears they have built DNS leakage into their new Behemoth !

https://forums.openvpn.net/topic19728.html