The issue you’re describing is likely due to a combination of DNS configuration and split-tunneling behavior. Here's how to troubleshoot and resolve the problem:
1. Check Internet access is restricted when connected to the VPN.
Users can ping public IPs (e.g., 8.8.8.8), so basic routing is working.
DNS resolution is not functioning for external FQDNs.
Problem affects specific platforms (MacBook, Android).
Possible Causes:
Incorrect DNS settings in the VPN configuration.
Split tunneling not configured properly.
DNS traffic from the affected devices may not be routed correctly through the VPN.
2. Verify FortiGate DNS Configuration
Ensure your FortiGate DNS settings are properly configured:
config system dns
set primary 8.8.8.8
set secondary 8.8.4.4
end
3. Check the Mode-Config Settings
Ensure the VPN server is pushing the correct DNS servers to clients:
config vpn ipsec phase1-interface
edit "<your_phase1_name>"
set mode-cfg enable
set ipv4-dns-server1 8.8.8.8
set ipv4-dns-server2 8.8.4.4
next
end
4. Enable Split Tunneling (Optional)
If you want to allow users to access the Internet directly while connected to the VPN, configure split tunneling:
Enable split tunneling in your phase 1 configuration:
config vpn ipsec phase1-interface
edit "<your_phase1_name>"
set split-tunneling enable
next
end
Define the networks that should route through the VPN (e.g., your internal subnets):
config vpn ipsec phase1-interface
edit "<your_phase1_name>"
config split-tunneling-routing-address
edit 1
set subnet 192.168.1.0 255.255.255.0
next
end
next
end
5. Check FortiClient Configuration
Ensure the FortiClient is correctly configured to handle DNS:
In FortiClient, verify that "Use this connection only for resources on its network" (split tunneling) is enabled.
Ensure the DNS settings in FortiClient align with the pushed settings from the FortiGate.
6.Test DNS resolution:
nslookup google.com
Android:
Check if the Android device is using private DNS (Android 9 and above). If "Private DNS" is enabled with a custom DNS provider, disable it or adjust it to work with your VPN configuration.
Test DNS resolution using a network diagnostic app.
7.Verify DNS traffic on the FortiGate:
diagnose sniffer packet any "port 53" 4
8. Potential External Issues
If these steps don't resolve the problem, consider these possibilities:
A recent update to FortiClient or the affected operating systems introduced compatibility issues.
A recent FortiGate firmware update might require reviewing the release notes for known issues.
