Azure VPN Client (P2S AAD) not resolving Private ARO custom domain via DNS Private Resolver – works only with hosts file

Sivasankar S 0 Reputation points
2026-06-28T06:30:56.48+00:00

Hi Team,

I am trying to access a Private Azure Red Hat OpenShift (ARO) cluster using a custom domain from a Windows machine over a Point-to-Site VPN (Azure VPN Client with AAD authentication), but DNS resolution is not working.

Scenario:

  • Private ARO cluster deployed in VNet (10.0.0.0/16)
  • Custom domain configured for ARO apps (e.g., apps.example.com)
  • VPN Gateway: VpnGw2AZ
  • Azure VPN Client (OpenVPN + AAD authentication)
  • Azure DNS Private Resolver deployed with inbound endpoint: 10.0.10.4
  • Private DNS zones (ARO + custom domain) linked to the VNet

Problem:

I am unable to access the ARO cluster using browser:

Examples:

https://api.cluster.example.com

https://console-openshift-console.apps.cluster.example.com

  • Browser cannot resolve or connect
  • nslookup resolves via public DNS (8.8.8.8) instead of private IP
  • VPN adapter does not show any DNS server

Workaround:

If I manually add entries in Windows hosts file:

<private-ip> api.cluster.example.com

<private-ip> console-openshift-console.apps.cluster.example.com

Then browser access works correctly.

Configuration attempts:

  • Configured VNet DNS servers → 10.0.10.4 (Private DNS Resolver inbound endpoint)
  • Downloaded new VPN client profile after DNS change
  • Modified azurevpnconfig.xml: <dnsservers> <dnsserver>10.0.10.4</dnsserver> </dnsservers>
  • Re-imported VPN profile

Issue:

  • VPN client still uses public DNS
  • DNS settings from XML or VNet not applied
  • Custom ARO domain not resolving via Private Resolver

Expected behavior:

  • VPN clients should resolve custom ARO domain via Private DNS Resolver
  • Browser should access ARO API and Console without using hosts file

Questions:

  1. What is the recommended approach to access Private ARO clusters with custom domain over P2S VPN?
  2. Proper steps to create private aro cluster and access securely on windows machine web browser.

Any guidance would be helpful.

Thanks in Advance

Azure Red Hat OpenShift
Azure Red Hat OpenShift

An Azure service that provides a flexible, self-service deployment of fully managed OpenShift clusters.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vinodh247-1375 43,586 Reputation points Volunteer Moderator
    2026-06-28T10:59:59.78+00:00

    Hi ,

    Thanks for reaching out to Microsoft Q&A.

    Your issue is expected behaviour with P2S AAD + Azure VPN Client (OpenVPN), it does not reliably push custom DNS settings to the client, so your machine falls back to public DNS, which is why resolution works only via hosts file.

    The recommended approach is: do not depend on the VPN client to inject DNS. Instead, explicitly control DNS resolution on the client side or via a reachable DNS forwarder. The clean pattern is to use Azure DNS Private Resolver with an inbound endpoint (which you already have) plus a DNS forwarder path from the client. Since Azure VPN Client does not enforce DNS, configure one of these:

    1. Best practice (enterprisegrade): Use a custom DNS forwarder (for example, Windows DNS VM or azure firewall DNS proxy) inside the VNet, forward queries to Private Resolver (10.0.10.4), and configure your client (manually or via corporate policy) to use that DNS server.

    Practical workaround: Manually set the VPN adapter DNS server to 10.0.10.4 after connection (or via PowerShell script).

    Alternative: Use conditional forwarders on your local machine (or corporate DNS) for cluster.example.com → 10.0.10.4.

    1. Avoid relying on <dnsservers> in azurevpnconfig.xml, it is often ignored with AAD/OpenVPN profiles.

    For Private ARO access design using azure Redhat openshift: deploy ARO private cluster, create private DNS zones for api and *.apps, link them to the VNet, use Private DNS Resolver, ensure VPN clients can reach the inbound endpoint IP, and enforce DNS resolution via a controlled DNS path (not VPN config). Once DNS is correct, browser access to API and console will work without hosts file.

    Overall, your networking is fine; your gap is client-side DNS enforcement, not ARO or Private Resolver.

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.