Why aren't my DNS queries forwarded to the DNS servers set on my Client VPN endpoint?
I want to know why DNS queries aren’t forwarded to the DNS servers set on my AWS Client VPN endpoint.
Short description
If you connect a client to a Client VPN endpoint with a target DNS server, then typically the queries are forwarded to that DNS server. In some cases, the DNS queries for NSLOOKUP might be forwarded to the client machine's local DNS server instead.
This behavior is because of faulty binding order in Windows (including Windows 2000/XP/7). The faulty binding causes OpenVPN clients to use the default network adapter's DNS settings rather than the VPN adapter's settings. To resolve this issue, change the binding order in Windows Registry to prefer the TAP-Windows Adapter V9.
If you're using a Windows 10 machine, then proceed to the Windows 10 command section of this article. The other methods don't apply to Windows 10.
Resolution
Modify the interface metric value for the interfaces to change the binding order. Use one of the following methods.
Modify the interface metric value using Microsoft Command Prompt or PowerShell
1. Connect to the Client VPN endpoint using the AWS Client VPN service.
2. Open Command Prompt or PowerShell in Administrator mode.
3. Run ipconfig /all to get a list of Ethernet adapters.
4. Note the Ethernet interface number with an exact description of "TAP-Windows Adapter V9".
5. Run this command:
netsh interface ipv4 set interface "Ethernet 4" metric="1"
Note: In the command, use the ethernet adapter interface number that you noted in step 4. If the command ran successfully, you receive an "Ok" code. Then, the DNS queries are forwarded to the DNS configured on the Client VPN endpoint.
Modify the interface metric value using Control Panel in Windows
1. Open Control Panel.
2. Choose Network and Internet, and then choose Network Connections.
3. Right-click the TAP-Windows Adapter V9 tap adapter.
4. Choose Properties, and then choose Internet Protocol Version 4.
5. Choose Properties, and then choose Advanced.
6. Clear the Automatic Metric box.
7. Enter 1 for Interface Metric.
8. Choose OK.
Windows 10 command
For Windows 10 machines, configure the interface metric with the Set-NetIPInterface PowerShell command:
Set-NetIPInterface -InterfaceIndex 4 -InterfaceMetric 1
InterfaceIndex is the interface number and InterfaceMetric is the metric value.
After you implement the workaround, run this command to check the preferred DNS servers:
netsh interface ip show config
Can you replicate this in MacOS
Thank you for your comment. We'll review and update the Knowledge Center article as needed.
For Windows 10 (and 11 at this point), you should run this first to see what your interfaces are:
# This gets all IPv4 interfaces, sorts them by their InterfaceMetric value, then formats them as a table while looking up their description Get-NetIPInterface -AddressFamily IPv4 | Sort-Object -Property InterfaceMetric | Format-Table -Property InterfaceIndex, InterfaceAlias, @{Label="InterfaceDescription"; Expression={(Get-NetAdapter -InterfaceIndex $_.InterfaceIndex).InterfaceDescription}}, InterfaceMetric, ConnectionState
You should see something similar to this:
InterfaceIndex InterfaceAlias InterfaceDescription InterfaceMetric ConnectionState
-------------- -------------- -------------------- --------------- ---------------
13 Local Area Connection TAP-Windows Adapter V9 for OpenVPN Connect 1 Disconnected
8 Ethernet 2 Realtek USB GbE Family Controller 5 Disconnected
3 Ethernet Intel(R) Ethernet Connection (16) I219-LM 25 Connected
21 Ethernet 3 AWS VPN Client TAP-Windows Adapter V9 25 Connected
A lower InterfaceMetric gives higher priority when selecting an interface to route through.
Relevant content
- asked 4 years ago
- asked 2 years ago
- asked a year ago
- Accepted Answerasked a year ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
