> Source: [sk171378](https://support.checkpoint.com/results/sk/sk171378)

# sk171378 - When connecting with E84.x, most requests are sent to the original DNS server configured on the computer, instead of to the DNS servers provided by the VPN client

| Property | Value |
|----------|-------|
| Solution ID | sk171378 |
| Date Created | 2021-01-06 |
| Last Modified | 2021-03-01 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Gaia |

## Symptoms

- When the user connects with E84.x, most requests are sent to the original DNS server configured on the computer, instead of to the DNS servers provided by the VPN client.

## Cause

Starting from Windows XP, Windows has an [Automatic Metric feature for IPv4 routes](https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/automatic-metric-for-ipv4-routes). When you enable this feature for network interface (it is enabled by default), Windows assigns a metric value to an interface based on its type (LAN/WLAN) and speed.  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171378/Automati_Metric_feature202101171754441.png)  

For example, on a Windows 10 machine, 1Gbit LAN interface (most typical case) would be assigned a metric of 25. However, the Virtual Network Adapter (VNA) installed by the VPN client on the same machine is also assigned a metric of 25 by the Automatic Metric feature, as the VNA speed is 1Gbit. This could lead to DNS resolving problems when VPN tunnel is installed.  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171378/Example202101171755182.png)  
(Ethernet = VNA, Ethernet0 = LAN)  

Consider: a public DNS is set on a physical LAN interface, and when the tunnel is installed some internal/domain DNS is set on the VNA. When the client attempts to access some internal resource by its DNS-name (expecting that it would be resolved by the internal DNS), the DNS requests for internal resource would be sent through the DNS that is set on physical interface, since the default route on the LAN interface would have a metric of 25, and the route to the internal DNS set on the VNA would have a metric of 26 = 25 + 1. Thus, the DNS on the LAN interface would be preferred. This behavior would lead to a connectivity problems when accessing internal resources (access could take longer than usual or be rejected because of timeout).  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171378/Example_1202101171757533.jpg)  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171378/Example_2202101171758204.jpg.png)  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171378/Example_3202101171758385.jpg.png)

## Solution

This problem was fixed. The fix is included in:

* [Enterprise Endpoint Security E84.40 Windows Clients](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk171419)

Check Point recommends to always upgrade to the most recent version ([Remote Access (VPN) / Endpoint Security Clients](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=175)).
If you do not wish to upgrade, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.   
The fix is a fixed based client, meaning it does not require installation of a patch on the gateway/management but on the client side.

A possible **workaround** for the issue it to manually assign the VNA metric a value of 1:  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171378/WA_Example202101171759226.jpg)  

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content