DNS issues when connecting to VPN

[TomPhil]

Hi

We joined Sky Broadband last week. Set up all went fine until I tried to use my work laptop. It connected to the wi-fi no problem, but was unable to connect to my work VPN (and couldn't load web pages etc, even though it was showing that it had internet access through the wi-fi).

My work IT team solved this by getting me to go into the properties for my Wi-Fi and change the setting to "obtain DNS server automatically". This worked and I was able to use the VPN quite happily for a week.

Yesterday, had exactly the same problem, except this time the PC would not allow me to authenticate as an admin to access the wi-fi settings. I had to take the laptop to the office and connect to the LAN so that the settings could again be changed to "obtain DNS server automatically". 

When I asked the IT support guy what was causing this he asked if I was with Sky Broadband and, when I said I was, he said this is a known problem with Sky Broadband and something needs to be changed in the router settings to avoid it applying DNS settings which is blocking the VPN. 

Any ideas of what it is I need to change? 

Thanks in advance. 

[Chrisee]

@TomPhil your IT guy is mistaken as there are no settings in the interface for Sky hubs that can change  the DNS settings which are hard wired to use Sky's DNS servers.

Couple of suggestions first log into the My Sky app and turn off the Broadband Shield as there have been reports that even when set to 18 can stop some private VPNs connecting. Second is to add a public DNS address to the network settings on the device you use - Google's public DNS should work which is 8.8.8.8.- which will over ride the Sky system 

[TomPhil]

@Chrisee Thanks for your reply. I've spoken to my IT team again for some further clarification and they said this:

"The moment the laptop connects to the WiFi, it caches a DNS which is restricting the VPN. The moment a DNS setting gets cached, the VPN will not connect and will need to be wiped."

I'm told that this problem comes up all the time with colleagues who switch to Sky and there's a setting in the router that needs to be changed (but unfortunately my IT colleague didn't know which one!)

Does this mean anything to you? 

Thanks. 

[Chrisee]

@TomPhil frankly no idea what they are talking about. DNS stands for Domain Name Server which is server that holds a list of IP addresses to connect to when your device requests a web address. It works like a telephone directory. With a Sky hub all such requests go to Sky's DNS servers. However if your device is set to use a different DNS service like Googles that over rides the Sky servers. The hub is not caching anything as far as I know @TimmyBGood or @jamesn123 do you know what they are talkinh about

The only major difference with Sky's DNS is it passes through a filter called Sky Broadband Shield which is user configurable by default ir is set to age 13 but you can change that setting to 18 or off in the My Sky app. My best guess is that is what your IT guy is thinking of.

[TomPhil]

@Chrisee Sorry, I don't think it makes any difference to your reply, but when he says "it" is caching a DNS, I think he means the laptop is caching a DNS, rather than the router is caching a DNS.

[Chrisee]

@TomPhil as I explained you cannot " cache a DNS" as such. I suppose they might be referring to an IP,address the server returns to the query but quite what they mean defeats me which is shy have tagged two other SUs who have more knowledge on how these systems work..

However have you disabled Sky Broadband Shield as that has caused issues in the past with a few VPNs?

[TomPhil]

@Chrisee Yes, I've disabled Sky Broadband Shield.

Thanks for tagging the other SUs. 

Re the "caching", I think what they mean is this. On the laptop, in the network adapter settings, there is an option where you can either select to obtain the DNS server address automatically or you can specify a particular DNS server address. When you go into these settings, it's set to use a specific DNS server, which I think they are referring to as "caching". They are then "wiping" that by deleting the address of that DNS server and setting it back to automatic.

The first time they tried this (the day we joined Sky Broadband) this actually fixed the problem and it worked fine for a week, but the problem now is that the laptop won't even let me access those settings (because the settings require administrator privileges and the problem is preventing me authenticating as administrator).

I appreciate this is all a bit confusing: I'm quite techie myself and I can't understand it! However, they insist that this happens all the time when people join Sky (we're quite a big company, so we must have loads of people on Sky) and that there is some kind of easy fix?! Just hoping someone on here knows what it is.

[Chrisee]

@TomPhil as far as we know you can bypass Sky's DNS by entering a different DNS server on the device. It might help if you posted which VPN software your company uses. 

[jamesn123]

Hi @TomPhil 

I know exactly the settings & polices you are referring to as I manage this kind of thing for a Job.

What your IT admin is saying is in a sense correct but at the same time its not. I understand that he is saying your laptop needs a specific DNS set in its network adapter to be able to connect to the VPN, this should be set manually at the time of setting up the network or via a domain GPO (Group Policy).

However your Sky router cannot change this setting in Windows, no matter how much it may want to force you to use Sky's DNS it has no way of changing that setting. Therefore either something on your laptop or something on your corporate network (possibly a GPO) is forcing the setting back to automatic. Your IT admin should investigate this and either figure out what this 'magic' setting is or solve the problem of your laptop switching back to automatic DNS (Which the Sky router certainly can not do).

[cuke]

When we introduced VPN as a way for teachers/admin/support staff to work from home we found that it was the  broadband shield that was causing connection issues and this needed to be turned off.

[TomPhil]

@jamesn123 Thanks very much for this. I think it's the other way around though - they are saying that it should be set to automatic, rather than a specific DNS address. That's what they did to fix it initially and it worked. When the problem reoccurred and they were able to get into the settings again, again it was set to a specific DNS address and they said it needed to be switched to automatic.

I do find it weird how this can be something to do with Sky, but I've been using the VPN for months through EE broadband with no issues, and it was the first time that I tried to connect to Sky that the problem occurred. 

[jamesn123]

@TomPhil 

OKay so if its being set from Automatic to Manual what is the DNS address in the box? Curious to know what its being forced set as. 

[TomPhil]

@jamesn123 Sorry, I'm not sure. My IT team deleted it when they set it back to automatic. It looked the same both times and it wasn't any of the standard ones (I've Googled a list of common DNS servers and also Googled what Sky's DNS servers are and it wasn't any of those).

I was wondering whether it was something on my work network that keeps setting the DNS settings back to a specific server and that for some reason Sky doesn't like that server, hence switching it back to auto uses Sky's DNS servers and fixes the problem (but only temporarily until the work network imposes its own preferred DNS again). However, our IT guy is insistent that when other people had this problem it had to be fixed at Sky's end.

The other weird thing is that after I connected it to my Sky router, I tried connecting it to another network to see if it was a Sky specific problem and it wouldn't work on that network either. My IT guy says that once someone has tried to connect to a Sky router, this then stops the VPN working on any network until DNS is set back to automatic.

A couple of other things which probably aren't relevant but I'll throw them in just in case. 

Firstly, when I connect to the Sky router on my laptop it is often initially saying connected with no Internet, and I have to reconnect or wait a bit for it to get Internet. Don't seem to have this with any other device in my house, and the laptop had no delay getting Internet with my old router. 

Secondly, I have a TP-Link repeater / range extender device downstairs. I initially try to connect to the router direct, but if that doesn't work I try to connect to the extender. I have the same problem with the VPN regardless. I don't think it's an issue with the repeater though because I used the same device with my previous router no problem, and the laptop did connect via the repeater with no problems for a few days last week. 

[jamesn123]

---

@TomPhil wrote:

I was wondering whether it was something on my work network that keeps setting the DNS settings back to a specific server and that for some reason Sky doesn't like that server, hence switching it back to auto uses Sky's DNS servers and fixes the problem (but only temporarily until the work network imposes its own preferred DNS again). However, our IT guy is insistent that when other people had this problem it had to be fixed at Sky's end.

---

Yes this is almost certainly what is happening, as I mentioned before it is likely your company is setting the DNS via GPO so everytime you connect to the corporate network either in the office or via VPN it is picking up this setting again and forcing it. However I do not know why Sky broadband doesnt like this and as others have mentioned I do not know of any Sky router setting that would fix this other than the Sky shield which you mentioned you already switched off. 

---

@TomPhil wrote:

Secondly, I have a TP-Link repeater / range extender device downstairs. I initially try to connect to the router direct, but if that doesn't work I try to connect to the extender. I have the same problem with the VPN regardless. I don't think it's an issue with the repeater though because I used the same device with my previous router no problem, and the laptop did connect via the repeater with no problems for a few days last week. 

---

Could you just try unplugging the TP-Link repeater from the wall & then connecting your laptop via ethernet? This will 100% rule out any 3rd party interference.