Split DNS support for FortiClient (Linux) SSL VPN 7.2.2

FortiClient (Linux) now supports split DNS tunneling for SSL VPN portals, which allows specifying which domains the DNS server specified by the VPN resolves, while the DNS specified locally on the network adapter resolves all other domains. If you disable Prefer SSL VPN DNS, EMS does not add the custom DNS server from SSL VPN to the physical interface. When enabled, EMS prepends the custom DNS server from SSL VPN to the physical interface. When SSL VPN is connected, users often must resolve internal hostnames that public DNS servers cannot resolve. To make internal hostnames resolvable, you should configure the SSL VPN portal with internal DNS server using split DNS.

To configure an SSL VPN full tunnel with split DNS in FortiOS:

1. In FortiOS, go to VPN > SSL-VPN Portals.
2. Create an SSL VPN portal with a full tunnel.
3. Under Tunnel Mode Client Options, enable DNS Split Tunneling.
4. Under Split DNS, click Create New.
5. In the Domains and Primary DNS Server fields, enter the domain and IP address of the primary DNS server. Click OK.
6. Add other domains and IP addresses for DNS servers as required. Click OK.

   

7. Go to VPN > SSL-VPN Settings.
8. Under Tunnel Mode Client Settings, for DNS Server, select Same as client system DNS or Specify. If you select Specify, enter the DNS server IP address. Click Apply.

To configure an SSL VPN full tunnel with split DNS in EMS:

1. In EMS, go to Endpoint Profiles > Remote Access.
2. Select the desired profile or create a new one to add the SSL VPN tunnel that you created in FortiOS.
3. Under SSL VPN, enable Prefer SSL VPN DNS.
4. Click Save.

   

When FortiClient (Linux) connects to the SSL VPN tunnel, it supports split DNS tunneling.