I've set up an openvpn server on a debian 9 device so that my colleagues can access our public cloud infrastructure from the private interfaces. I'd like them to access servers via hostnames so I've installed a Bind9 DNS server. This DNS's only purpose is to resolve private names of all our servers so I've disabled recursion (I'm not sure if I am supposed to, I'm a noob at DNS but I guess it is more secure to not communicate with other dns since it's our internal DNS). From the openvpn server, I push the DNS configuration to my clients :
push "dhcp-option DNS X.X.X.X"
push "dhcp-option DOMAIN mydomain.com"
push "register-dns"
However, my colleagues still need to use internet while connected to the VPN. On Windows clients, with this configuration, they can use internet but not resolve our servers' hostnames. They are still using the default DNS (from their ISP). I can force clients to use the internal DNS with :
push "block-outside-dns"
But they can't use internet then since there is no recursion on the internal DNS. Is there any way to make the clients use the internal DNS for VPN traffic and their ISP's DNS for internet traffic ? Should I allow recursion on the internal DNS ?
