How to force DNS query pass into SSL VPN tunnel

Zyxel_Stanley
Zyxel_Stanley Posts: 1,378  Zyxel Employee
100 Answers 1000 Comments Friend Collector Seventh Anniversary
edited April 2021 in Security

Here is a SSL VPN scenario. Client is able to establish SSL VPN tunnel successfully and USG enabled “Force all client traffic to enter SSL VPN tunnel” in SSL VPN tunnel.

However, the DNS queries were still sent out from the Ethernet interface(192.168.1.1) but not go through the SSL VPN TAP tunnel interface (192.168.22.5).

The reason is that the Windows platform will keep using the interface DNS server IP as its preferred DNS server by default.


In this case, you can change the SSL VPN TAP interface metric to 1 and higher the interface priority.

Then SSL VPN interface priority will become higher than Ethernet interface and the DNS query will be sent out through the SSL VPN tunnel.

Go to configure your TAP interface > Edit IPv4 IP address > Click Advanced > Change Interface metric as 1.


Security Highlight