> Source: [sk168058](https://support.checkpoint.com/results/sk/sk168058)

# sk168058 - "Route all traffic" (Hub mode) is "ON", but some DNS queries are sent through physical interface

| Property | Value |
|----------|-------|
| Solution ID | sk168058 |
| Date Created | 2020-07-23 |
| Last Modified | 2020-07-27 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |

## Symptoms

- * "Route all traffic" (Hub mode) is "ON", but some DNS queries are sent through the physical interface.
* In Wireshark, user can see DNS queries on the physical interface.

## Cause

Starting from Windows 8, Microsoft has changed DNS resolving behavior. Windows DNS resolver sends DNS requests (in parallel) to all available network interfaces, and uses the fastest reply. That creates an issue for all VPN client solutions to route DNS traffic through the tunnel.  

**More information:**   
<https://social.technet.microsoft.com/Forums/en-US/d5a86da9-6866-4f02-b71b-d58a1f3d2fc2/windows-10-vpn-dns-problem?forum=win10itpronetworking>  

<https://medium.com/@ValdikSS/beware-of-windows-10-dns-resolver-and-dns-leaks-5bc5bfb4e3f1>

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content