---
title: Access Server and DNS Configuration Guide
canonical: https://openvpn.net/as-docs/v3/dns/
product: Access Server Docs
description: DNS configuration options for Access Server include pushing specific DNS servers to clients and creating a split-DNS setup.
keywords: DNS
---

# Access Server and DNS Configuration Guide

This page provides information about the Domain Name System (DNS) and Access Server.

## How DNS works

The Domain Name System (DNS) maps domain names to IP addresses using name resolution services. When you enter a domain name in a browser, DNS translates it to an IP address to connect you to the correct destination.

## DNS and Access Server

You can configure DNS for clients that connect to your Access Server. Access Server can have clients use the same DNS servers as the Access Server host, push specific DNS servers for clients, or not alter clients' DNS servers.

You can set these options in the Admin Web UI on the **Internet Access and DNS** tab under **Access Controls**.

You can also alter DNS resolution zones and default domain suffix settings on the **Interet Access and DNS** page. DNS resolution zones allow you to configure a split-DNS setup, defining DNS zones that resolve to DNS servers pushed from Access Server.

An optional, Windows-OS-specific setting is the DNS domain suffix because Windows clients might only use the first domain provided in DNS resolution zones.

For more, refer to the user manual's [Access Controls](https://openvpn.net/as-docs/v3/access-controls.md).

## Domain Routing via DNS

Access Server 3.1.0 introduces built-in [domain-based routing](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-in-access-server.md) using a DNS engine. This allows you to route traffic by domain name without redirecting all traffic or maintaining large lists of IP addresses for content delivery networks (CDNs).

Here's how it works:

- VPN clients use the Access Server's internal DNS engine.
- Specific domains are resolved to private IPs reserved for routing through the VPN tunnel.
- Access Server NATs traffic destined for the actual destination using `nftables`.
- You can define domains to route (or exclude from routing) on a global, group, or per-user basis.

> **Important**
>
> - This feature helps control access to SaaS services like **salesforce.com** without full-tunnel routing.
> - The NAT implementation for domain routing is based on `nftables`, which is the preferred firewall engine. `iptables` is no longer recommended and may be deprecated.

> **Note**
>
> **Configuration Notes**
>
> - The DNS engine listens on the VPN gateway's IP address (e.g., the first IP address in the VPN subnet) on port 953.
> - You can configure:
>   - The private IP range for routed domains.
>   - Custom upstream DNS resolvers.
>   - Routed domains (include/exclude lists) per user/group.
> - Changing domain settings typically requires reconnecting affected users.

### Related tutorials

- [Tutorial: Configure Domain Routing in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-in-access-server.md) — Explains what domain routing is and how to configure it using the Admin Web UI.
- [Tutorial: Step-by-Step Examples for Split Tunnel and Role-Based Access Using Domain Routing](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-split-tunnel-and-role-based-access.md) — Provides practical use cases for domain routing, including split tunneling and role-based access, with verification steps using the Access Server CLI.
- [Tutorial: Configure Domain Routing Rules in Access Server from the Command-Line Interface](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-via-cli.md) — Shows how to configure domain routing rules using the CLI and verify that they are applied correctly.
- [How to Configure Domain Routing in Access Server](https://www.youtube.com/watch?v=ZLEhDTKMnGM&t=2s) — Video walkthrough demonstrating how to set up domain routing in Access Server.
- [Tutorial: Configure Domain Routing Settings Using the Access Server CLI](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-settings-via-cli.md) — Explains the domain routing–related directives, what they control, and how to modify them using the CLI.
- [Tutorial: Configure DNS Settings in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--configure-dns-settings.md) — Covers general DNS configuration in Access Server and how domain routing affects DNS behavior.

---

Prev: [NAT and Routing](https://openvpn.net/as-docs/v3/nat---routing.md)
Next: [Point-to-Site Routing](https://openvpn.net/as-docs/v3/point-to-site.md)
Index: https://openvpn.net/as-docs/llms.txt