Force Windows to Use a VPN's DNS Server

I often connect to my home network when I'm on the road, to encrypt my traffic as well as access my computers at home. Unfortunately, even though I had set up the VPN as the default route ("Use default gateway on remote network"), which encrypted most traffic, I noticed that my DNS queries were still being passed to the local (untrusted) DNS server rather than the one at home. Not only is this insecure, it also makes it difficult to use the hostnames of my home network devices.

Fortunately, the fix is pretty easy once you know it. Based on Microsoft KB311218, I discovered that the problem is a faulty binding order, which causes the dialup/VPN network adapter to be secondary to the local network adapter(s) with respect to DNS priority. These steps fixed my problem:

  1. Open Regedit.
  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage
  3. In the right pane, double-click Bind
  4. In the value text box, select the "\Device\NdisWanIp" item, press CTRL+X, click the top of the list of devices, and then press CTRL+V.
  5. Click OK, and then quit Registry Editor.
  6. Restart your VPN connection.

The article only mentions 2000 and XP, so hopefully Vista and Windows 7 don't suffer from this problem.

Comments

  • John
  • April 3, 2010
  • 2:13 pm
Your procedure, slightly adapted, worked beautifully on my Windows 7 laptop running the Cisco VPN client.
Instead of performing step 4 as you've listed,(because my Bind pop-up window provided me with non-human readable strings) I simply cut the string at the bottom of the Bind list and pasted it at the top so that it was the first entry. I closed the Registry Editor and restarted the VPN client. It now works like a charm.!!!
After looking at over 100 web forums for help, this was the one that made the critical difference. thanks!!!
John
  • Bill
  • May 29, 2010
  • 4:41 pm
Great post. Also helped me as well with Win7 and a Fortigate SSL VPN dns issue.
  • Carlos
  • June 29, 2011
  • 7:43 am
Thanks a lot that helped me too with WIndows 7 and Cisco VPN client. I also had only GUIDs in this registry key and no clue which of this GUIDs was my Cisco VPN adapter. After a little bit searching around in the registry I found the following key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards]

I compared the content of the Linkage key with the GUIDs of the nic in the network cards key and was able to find all guids but one. That one was the GUID of the Cisco VPN adapter. I moved this GUID to the top of the list and the bindung order was correct again.

Carlos
Great addition, Carlos. Thanks!
  • Victor
  • August 17, 2011
  • 5:35 am
Thank you! This helped me to resolve DNS problem on my Windows 7 x64 box using Cisco VPN client.
  • wharton
  • February 13, 2012
  • 10:26 am
Thanks, it helps me, and alittle different from Carlos', i find the GUIDs Under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
click each GUID, we can see the details includes DNS value...

  • pds
  • March 22, 2012
  • 12:41 am
Nice post, fixed my wagon too. I'm using Cisco VPN 5.07 on Win7 64 and could not figure out how to set DNS priority for my VPN over my local network.

Many Thanks!
  • Insitec helpdesk
  • May 2, 2012
  • 3:23 am
Also -try using NETSH to define the primary DNS for the VPN tunnel.
EG :
netsh int ipv4 set dns name="vpn linkname" static 192.169.0.3 primary

where 0.3 is the prefered DNS server, sets it as the primary DNS.
vpn linkname will be a variable for your system, so change this as required, and is typed in " " marks
  • Trey Bianchini
  • May 18, 2012
  • 8:29 pm
just like they said I figured out which one of the interfaces was the vpn and put it on the top of the bind list and I am resolving....

Thank YOU!!!!!!!!!!

This was driving me nuts!
  • Josh
  • August 3, 2012
  • 12:42 pm
The regedit commands did not work for me (windows 7 professional), but the netsh command did the trick. It should be noted that the 'name=""' part refers to the name of your connection - in my case it was "Local Area Connection 2". Thanks!!
  • Eugene
  • August 8, 2012
  • 4:46 pm
Hi. I have an issue with Cisco VPN and Windows 7.
This solution works like a chamr but.
Is there any way to do this change permament for USB Modems ???
I see that when i disconnect and connect again USB Modem rewrite again HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage
and and guid show on first place.

I know i can put more than one copy of this string on bottom, but when i recconect my interent one of this string will be deleted.

Is there any way to do this permament to show win7 that when i establish VPN connection use DNS from VPN not from IPS ???

I use advance settings for network cards, and my VPN connection is on first place too.

There is one wat to do this but not premament. When i go to advance setting for ipv4 in cisco vpn and don't change anything but use ok then ok and ok I saw that my dns change to right one from vpn.

O and ofc on XP works like a charm :)
  • JC
  • September 14, 2012
  • 4:06 pm
Hi everyone. I would like to know how can I bind to interfaces using DNS servers with netsh and then, how Can I order my vpn server on debian to give address to my openVPN Tap in windows?
  • Panta
  • October 25, 2012
  • 3:14 pm
Thanks for the fix. What an obscure bug.
  • Reader
  • February 14, 2013
  • 7:05 am
But this priority is only working, if the answer comes back in 1 second. Then the other servers will be asked and thats a security problem - could be.

Leave a Comment

  • After submission, your comment will be held for moderation until it is reviewed

Please wait ...

There was an error fetching the requested dialog.