DNS lookup issues with Microsoft Tunnel Gateway

Question

Hey, So on my Intune journey for corporate managed Android, we have an app which will require the traffic being routed back via our network as it isn't publicly accessible.

I've setup the Tunnel Gateway and can confirm its healthily in Endpoint Manager, I have a configuration pushing to a test use and can confirm the Defender app connects to the Tunnel successfully. Its setup to use one NIC on the VM and is located in the DMZ.

In the server configuration I have the DNS pointing to the DNS I have in the DMZ and the split tunnel config set to the IP of the resource the app needs to hit.

From the tunnel VM I can ping the app resource via IP or via hostname so the VM is looking up by DNS ok. I can also ping Google.com so external DNS lookup is working ok. I can also access internet resources from the VM as it downloaded the files etc needed for building the Tunnel in the first place.

From the device as a test I've setup Edge to use the Tunnel VPN I can connect to the resource I want using IP but if I try using its FQDN is fails which suggests a DNS issue. I also can't access google.com from Edge.

Any pointers to where I might be going wrong?

Answer 1

@DaveK , From your description, it seems the network access via Microsoft Tunnel Gateway is working well. But when we use FQDN it is failed. And google.com is also not accessible.

To clarify our issue, please firstly check if the issue is only with one Android device. If it is only with one, it seems the issue is on device side. we can try to clear the cache on the device and restart the device to see if it can work.

If the issue is not only on this affected device, based on my experience, we can check if we get the correct DNS server we want. On DNS server, check if the DNS request has been sent to the DNS server and if it get any error when resolve the FQDN. Also we can view Microsoft Tunnel logs to see if there's any more finding.
https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-tunnel-monitor#view-microsoft-tunnel-logs

If we want the help to look into the logs, to protect the sensitive information in your environment, we suggest to open case to troubleshoot on it. Here is a link with the steps to open case for your reference:
https://learn.microsoft.com/en-us/mem/get-support

Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@DaveK ,Thanks for sharing the solution. I appreciate it. To help others who have the same issue. Here, Please let me write a brief summary for our issue:

Issue definition:

==========================

After set Edge to use the Tunnel VPN, connect to the resource by IP is working but if we choose its FQDN, it is failed with a DNS issue. And google.com is also not accessible at that time.

Resolution:

===========================

The issue is caused by a missed firewall config in the perimeter in which only TCP 443 was open. On adding UDP 443 into the rule as well, DNS started to work.

Thanks for your time and have a nice day!

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.