Skip to main content

Tutorial: Configure DNS Settings in Access Server

Abstract

Configure DNS settings in OpenVPN Access Server, including DNS proxy modes, DNS servers, split DNS (resolution zones), and how DNS interacts with domain-based routing.

Overview

The Domain Name System (DNS) translates domain names into IP addresses so clients can connect to resources. In Access Server, DNS settings determine how connected VPN clients resolve domain names and which DNS servers they use.

Access Server can:

  • Use the same DNS servers as the host system.

  • Push specific DNS servers to VPN clients.

  • Leave client DNS settings unchanged.

Access Server also supports advanced configurations, such as default domain suffix, split DNS (resolution zones), and integrates with domain routing, where DNS responses control how traffic is routed through the VPN.

Prerequisites

  • Access Server installed and running

  • Access to the Admin Web UI

Step 1: Configure the DNS proxy mode

  1. Sign in to the Admin Web UI.

  2. Select Access Controls → Internet Access and DNS.

  3. Under DNS Server Proxy, select one of the following:

    • Auto (Default) — Clients with domain routing rules have their DNS queries proxied through Access Server. All other clients query the specified DNS servers directly.

    • Always Proxy — Access Server proxies DNS for every client and forwards queries to the DNS servers you configure. (Some Access Server versions label this as Always.)

    • Off — Access Server doesn't alter client DNS behavior. This disables domain-based access rules. (Some Access Server versions label this as Never.)

  4. Click Save and Restart.

Note

In Access Server 3.1.0 and newer, DNS proxy mode is set to Auto by default. In some upgrade scenarios, it may remain set to Off. DNS proxy mode can only be set to Off when using split tunnel.

Step 2: Configure DNS servers

Access Server 3.2.2 separates DNS server configuration into two distinct settings, now visible as separate fields in the Admin Web UI:

Upstream DNS

Upstream DNS is the DNS server Access Server's DNS proxy uses to resolve queries on behalf of clients with active domain routing rules.

  1. Under Upstream DNS, select:

    • Autodetected (default) — Access Server uses the DNS server detected from the server's operating system. The detected IP address is shown below the field.

    • Custom — Enter a specific DNS server IP address.

  2. Select Save.

To configure via CLI:

  1. Connect to the console and get root privileges.

  2. Run:

    sacli --key "dnsproxy.upstream_dns" --value "<DNS_SERVER_IP>" ConfigPut
sacli start

  3. To reset to autodetected:

    sacli --key "dnsproxy.upstream_dns" --value "auto" ConfigPut
sacli start

Client DNS

Client DNS is the DNS server that Access Server advertises to VPN clients that do not have domain routing rules active. These clients resolve DNS queries directly against this server rather than through the DNS proxy.

  1. Under Client DNS, select:

    • Autodetected (default) — Uses the DNS server detected from the server's operating system.

    • Custom — Enter up to three DNS server IP addresses.

  2. Select Save.

Note

Prior to Access Server 3.2.2, the DNS proxy used the same servers as Client DNS for its upstream resolver. As of 3.2.2, these are controlled separately. If you upgraded from an earlier version and notice changes in DNS resolution behavior, verify both Upstream DNS and Client DNS settings.

Tip

For the full list of DNS proxy configuration options including listening port and timeout settings, see Tutorial: Configure Domain Routing Settings Using the Access Server CLI.

Step 3: Configure default domain suffix (optional)

  1. In Default Domain Suffix, enter a domain (for example, company.local).

  2. Click Save and Restart.

What this does

This setting helps Windows clients resolve short hostnames to fully qualified domain names (FQDNs).

For example, if you have openvpn.com as the domain suffix, when you access awspc3, this resolves to awspc3.openvpn.com.

Step 4: Configure DNS resolution zones (split DNS)

Important

Split DNS requires enabling split tunnel, and for Access Server 3.1.0 and newer, these conditions need to be met:

  • DNS Server Proxy is set to Auto, and

  • No domain routing rules are applied to the user.

If the user has domain routing rules (at the global, group, or user level), Access Server doesn't push DNS zones to the client.

  1. In DNS Resolution Zones, click Add another DNS resolution zone.

  2. Enter the domain (for example, internal.company.com).

  3. Click Save and Restart.

What this does

Split DNS ensures that only the specified domains are resolved using the DNS servers configured in the DNS Servers section, while all other domains use the default DNS behavior.

Tip

Some clients (such as Windows) may only respect the first domain listed.

Step 5: Understand DNS behavior with domain routing

Access Server 3.1.0 introduces built-in domain-based routing using a DNS engine. This allows you to route traffic by domain name without redirecting all traffic or maintaining large lists of IP addresses for content delivery networks (CDNs).

Here's how it works:

  • VPN clients use the Access Server's internal DNS engine.

  • Specific domains are resolved to private IPs reserved for routing through the VPN tunnel.

  • Access Server NATs traffic destined for the actual destination using nftables.

  • You can define domains to route (or exclude from routing) on a global, group, or per-user basis.

This allows you to route traffic by domain name without requiring full-tunnel routing.

Example

Route traffic for a SaaS application (such as salesforce.com) through the VPN while allowing other traffic to go directly to the internet.

Note

Changes to DNS or domain routing settings may require users to reconnect.

Next steps

For configuring domain-based routing rules and advanced DNS proxy behavior, see:

In this section: