Skip to main content
New Member
June 12, 2026
Question

IPSEC, DNS, IPSEC Remote access

  • June 12, 2026
  • 2 replies
  • 154 views

Hello everyone. We bought a Fortigate 71g (7.6.7). I have experience using OpenVPN on Mikrotik and Pfsense. It was very convenient for remote access and local DNS access. The point is, we need to provide remote access to people without providing a DNS domain and server; we bind users by IP addresses, and that was sufficient. The problem is that I can't get the IPSec Fortigate to work without providing clients with a DNS server. All requests start going through the VPN tunnel, and access to local domains and DNS is lost.
Detecting the client's local DNS is not quite right. For example, OpenVPN has this block-outside-dns feature. Is there a solution?
Tried:
1) config vpn ipsec phase1-interface
    edit "test1"
        set dns-mode manual
        set ipv4-dns-server1 0.0.0.0
    next
end
2) I tried unset ipv4-dns-server1,2,3
3) ipsec Mode config - manual
4) in the client's config in XML: 
        <ipsecvpn>
            <options>
                <enabled>1</enabled>
                <beep_if_error>0</beep_if_error>
                <usewincert>1</usewincert>
                <use_win_current_user_cert>1</use_win_current_user_cert>
                <use_win_local_computer_cert>1</use_win_local_computer_cert>
                <no_dns_registration>1</no_dns_registration>
                <block_ipv6>1</block_ipv6>
                <uselocalcert>0</uselocalcert>
                <usesmcardcert>1</usesmcardcert>
                <enable_udp_checksum>0</enable_udp_checksum>
                <disable_default_route>0</disable_default_route>
                <show_auth_cert_only>0</show_auth_cert_only>
                <disallow_invalid_server_certificate>0</disallow_invalid_server_certificate>
                <check_for_cert_private_key>0</check_for_cert_private_key>
                <enhanced_key_usage_mandatory>0</enhanced_key_usage_mandatory>
                <prefer_ipsecvpn_dns>0</prefer_ipsecvpn_dns>
            </options>
The client config contains the line <block_outside_dns>0</block_outside_dns>, but it doesn't work.

2 replies

funkylicious
SuperUser
SuperUser
June 12, 2026

if you don’t want internal DNS servers to be pushed to clients and traffic being routed to the internal DNS, just configure public ones.

also, is the vpn configured as split-tunnel ( which means only certain subnets/hosts would be routed through it ) or is it full-tunnel ( all traffic, internal and internet is routed through it ? in which case you would need to also configured appropriate firewall rules for this traffic to reach the internet )  ?

config  vpn ipsec phase1-interface
    edit <vpn name>
        set dns-mode manual
        set ipv4-dns-server1 3.3.3.3
        set ipv4-dns-server2 4.4.4.4
end

"jack of all trades, master of none"
StefkzAuthor
New Member
June 12, 2026


config  vpn ipsec phase1-interface
    edit <vpn name>
        set dns-mode manual
        set ipv4-dns-server1 3.3.3.3
        set ipv4-dns-server2 4.4.4.4
end

Yes, I use split-tunnel.
If I do this, people will lose access to their local domain. We have clients who run VPNs with their own domains and DNS.

The main problem is that the <block_outside_dns>0</block_outside_dns> option on the client does not work.

I need forticlient clients not to receive DNS ip.

funkylicious
SuperUser
SuperUser
June 12, 2026

very unique situation, im not gonna lie for your use case.

if they are remote workers ( from home ) i would expect that they dont have or need access any local resources, like domain/dns but if they are working from a remote company/location then i would suggest setting up a site to site vpn tunnel instead.

as per the option you have found, it will only work for full-tunnel configuration from my understanding

https://docs.fortinet.com/document/forticlient/7.4.7/xml-reference-guide/96295/ike-settings#:~:text=0-,%3Cblock_outside_dns%3E,-When%20you%20enable

When you enable this setting, Windows uses only the VPN-pushed DNS server when using a full tunnel.

L.E. make sure that you have this option disabled under the <ike_settings></ike_settings> config in your xml file

"jack of all trades, master of none"
sw2090
SuperUser
SuperUser
June 12, 2026

inside mode config you could also set a domain (if you set dns mode to manual). If you do that only requests that have this domain will be resolved over the vpn and the rest will go to the users system dns. Maybe you could solve this with that?

StefkzAuthor
New Member
June 16, 2026

This isn't entirely true for outsourced workers. Not all PC specialists know how to check their domain (or even the computer name), and if there are many of them, all with different domains, that's a big problem. I know all the workarounds for this problem, including leaving the second gateway exclusively for OpenVPN/WireGuard (Mikrotik/Pfsense).