---
title: 'Tutorial: Configure Domain Routing Settings Using the Access Server CLI'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-settings-via-cli/
product: Access Server Docs
description: Configure Domain Routing in OpenVPN Access Server using CLI commands. Learn how to manage DNS proxy settings, IPv4/IPv6 routing behavior, and optimize domain-based access control.
---

# Tutorial: Configure Domain Routing Settings Using the Access Server CLI

## Overview

This tutorial shows how to configure and manage domain routing-related settings in Access Server using the command-line interface (CLI).

Domain routing allows you to control how DNS queries are handled and routed for specific domains. To support this, Access Server uses a DNS proxy to intercept client DNS queries and return VPN-routable IP addresses for matched domains.

When domain routing rules are active, the DNS proxy ensures that clients resolve those domains to addresses that can be routed through the VPN. For all other domains, DNS queries are handled normally using the [configured DNS server](https://openvpn.net/as-docs/v3/dns/#dns-and-access-server).

## Prerequisites

- Access Server 3.1.0 or newer.
- Root privileges on your Access Server's console.

## Step 1: Configure DNS Proxy mode

1. Decide which DNS proxy mode to use:
   - `auto` (default): Uses DNS proxy only when domain-based access rules are active; otherwise, queries go directly to configured DNS servers.
   - `always`: Forces all DNS queries through Access Server.
   - `never`: Disables DNS proxy (also disables domain-based routing rules).
2. Run the following command:

   ```
   sacli --key "dnsproxy.mode" --value "<VALUE>" ConfigPut
   sacli start
   ```

   > **Important**
   >
   > - In Access Server 3.1.0+, DNS proxy is enabled by default (`auto`).
   > - In some upgrade scenarios, it may remain disabled (`never`).
   > - DNS proxy can only be disabled when using [split tunnel](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-split-tunnel-and-role-based-access.md).

## Step 2: Configure IPv4 subnet for domain routing

1. Set the IPv4 subnet used for DNS-mapped addresses:

   ```
   sacli --key "dnsproxy.ipv4_pool_net" --value "<VALUE>" ConfigPut
   sacli start
   ```

   > **Important**
   >
   > - The default value is `100.64.0.0/10`.
   > - You don't typically need to change this unless it conflicts with your network.

## Step 3: (Optional) Configure DNS proxy listening port

1. Set the DNS proxy listening port:

   ```
   sacli --key "dnsproxy.listen_port" --value "<VALUE>" ConfigPut
   sacli start
   ```

   > **Important**
   >
   > The default port is `953`. Only change if there's a port conflict. Ensure you configure a port that won't conflict with Access Server [port settings](https://openvpn.net/as-docs/v3/tutorials/tutorial--web-services-interface-and-ports.md).

## Step 4: (Optional) Configure DNS forwarder timeout

1. Set the timeout (in seconds) for DNS responses:

   ```
   sacli --key "dnsproxy.forwarder_timeout" --value "<VALUE>" ConfigPut
   sacli start
   ```

   > **Important**
   >
   > The default is `15` seconds. This usually doesn't need adjustment.

## Step 5: (Optional) Configure IPv6 subnet for domain routing

1. Set the IPv6 subnet:

   ```
   sacli --key "dnsproxy.ipv6_pool_net" --value "<VALUE>" ConfigPut
   sacli start
   ```

   > **Important**
   >
   > - The default is `fd15:6e1d:c3ab:49c3::/64`.
   > - This applies only if [IPv6 is enabled](https://openvpn.net/as-docs/ipv6-support.md).
   > - Only change this if there's a subnet conflict. Ensure you configure a subnet that won't conflict with your existing configuration.

## Step 6: (Optional) Configure IPv6 (AAAA) DNS behavior

1. Decide how AAAA responses are handled:
   - `routed` (default): Allows IPv6 responses only when IPv6 routing is configured.
   - `all`: Discards all AAAA responses.
2. Apply the setting:

   ```
   sacli --key "dnsproxy.strip_aaaa" --value "<VALUE>" ConfigPut
   sacli start
   ```

   > **Important**
   >
   > - With `routed` (default):
   >   - If IPv6 routing isn't configured, AAAA responses aren't sent to VPN clients, even if a domain routing rule exists.
   >   - If IPv6 routing is configured, AAAA responses are allowed, and clients receive IPv6 addresses from the configured subnet.
   > - In most cases, the default setting is sufficient and doesn't require changes.

## Step 7: (Optional) Configure the upstream DNS server for the DNS proxy

> **Note**
>
> Available in Access Server 3.2.0 and newer.

1. Set the upstream DNS server used by the Access Server DNS proxy:

   ```
   sacli --key "dnsproxy.upstream_dns" --value "<VALUE>" ConfigPut
   sacli start
   ```

   > **Important**
   >
   > The default value is `auto`. When set to `auto`, the DNS proxy uses the DNS server configured on the Linux machine where Access Server is hosted. To use a custom upstream DNS server instead, set `<VALUE>` to the IP address of the DNS server.

---

Prev: [Tutorial: Configure Domain Routing Rules in Access Server from the Command-Line Interface](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-via-cli.md)
Next: [Tutorial: Configure Deny Rules with Domain Routing Using the Access Server CLI](https://openvpn.net/as-docs/v3/tutorials/tutorial--deny-rules-with-domain-routing.md)
Index: https://openvpn.net/as-docs/llms.txt