Win10: Split tunneling & DNS resolution of VPN network addresses

[Ellessar]

Hi fellow OpenVPNers!
I have been using openVPN in a number of settings, networks (like AsusWRT, Mikrotik or even self-compiled OpenVPN running in a Synology DSM Docker) without any great issues for years.
For the last 2 years I have been using Split Tunneling between my home and work network without any issues.
My home network is abc.local (GW 10.23.41.1).
My VPN (work) network is xyz.local (GW 10.23.40.1) with VPN in 10.23.60.0 range. On the VPN side, there is a router between 10.23.40.0 and 10.23.60.0 networks.

Issue:
Accessing VPN network via DNS "computer.xyz.local" worked and now it doesn't. There was NO change on server side, NO change on client side configuration. For the last couple of weeks I lost the option to access resources in the VPN network via querying DNS name from Windows 10 computers in my home network. All IPv6 is turned off in Adapter settings.
Using "nslookup computer.xyz.local" I get "Non-existent domain" error. As soon as I use "nslookup computer.xyz.local 10.23.40.1" I get the correct IP address. But I have to FORCE nslookup to use that server, it is not being used automatically anymore.

No issue:
It still works perfectly when I use Force Tunneling on Win10. It still works on my iPhone even in Split Tunelling mode. Direct IP address access works without any issues.

What's troublesome:
I cannot keep browsing Internet via my local LAN while accessing VPN resources via "FQDN". I either have to use IP addresses on the VPN network, or all my browsing (unnecessarily) goes through the VPN network.

View Originalclient.conf

dhcp-option DOMAIN-SEARCH xyz.local ;this is a newly introduced option in a bid for resolving the issue - had no effect
dhcp-option DNS 10.23.40.1
dhcp-option DOMAIN xyz.local
register-dns

"ipconfig /all":

Code: Select all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : MY-PC
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : abc.local
                                       xyz.local

Ethernet adapter Ethernet 2:

   Connection-specific DNS Suffix  . : abc.local
   Description . . . . . . . . . . . : ASUS XG-C100C 10G PCI-E Network Adapter
   Physical Address. . . . . . . . . : 3C-7C-3F-4B-6C-D3
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.23.41.20(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.23.41.1
   DHCP Server . . . . . . . . . . . : 10.23.41.1
   DNS Servers . . . . . . . . . . . : 1.1.1.1
   NetBIOS over Tcpip. . . . . . . . : Disabled

Unknown adapter OpenVPN TAP-Windows6:

   Connection-specific DNS Suffix  . : xyz.local
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-A9-6B-38-2B
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.23.60.2(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.128
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 10.23.60.0
   DNS Servers . . . . . . . . . . . : 10.23.40.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

"PS Get-NetIPInterface | Sort-Object Interfacemetric":

Code: Select all

ifIndex InterfaceAlias                  AddressFamily NlMtu(Bytes) InterfaceMetric Dhcp     ConnectionState PolicyStore
------- --------------                  ------------- ------------ --------------- ----     --------------- -----------
9       Ethernet 2                      IPv4                  1500              15 Enabled  Connected       ActiveStore
4       OpenVPN TAP-Windows6            IPv4                  1500              25 Enabled  Connected       ActiveStore

Thank you for your help and if you have a better idea for the title, please let me know.

[TinCanTech]

Have you tried with --block-outside-dns ?

viewtopic.php?t=22603#p68963