So I have a single subnet, flat LAN, multiple wired access points all in bridge mode.

I have ISC-DHCP server and Bind9 DNS server configured for dynamic DNS hosts etc. The DNS provides a local zone of my public domain, *.lan.publicdomain.com but is not externally marked as a server for that domain. Thus internal *.lan. hosts are on the LAN server and *.publicdomain.com hosts are on the external public DNS at 123reg.

I also have an OpenVPN port open on the public IP. Externally vpn.publicdomain.com leads to my current IP.

It all works, I can be on the VPN on 4G or public wifi ... or be on my local wifi and access all my LAN hosts either way. I can actually be on both my local Wifi and VPN at the same time.

The android issue is that while on the VPN going to say:


Will resolve correctly to somehost.lan.publicdomain.com and the site will open.

If however I disconnect from VPN and just connect to my bare Wifi, my phone will still access somehost, but it will not resolve it without specifying the FQDN. It's like it will accept the search-domain from the VPN DHCP pool, but it will not accept it from the ISC-DHCP server locally.

Is this something to do with Android forcing DNS to avoid adblocks? Only when on VPN they can't get away with doing that as it's insecure and corporate types would object loudly.

I should note that all normal LAN clients, like Windows10, Linux etc, all honor the search domain in DHCP. Just not the android in LAN mode.

Phone is MotoG5 Plus, android: 8.1.0

  • Check Android network settings if "Private DNS" (or similar) is enabled. If it is enabled it may ignore your local DNS config outside of VPN. Not sure if it would make a difference if your local DNS server would support DNS over TLS or HTTPS. – Robert Apr 13 at 14:43
  • Related answers: android.stackexchange.com/… – Irfan Latif Apr 13 at 15:24
  • The issue appeared to resolve itself. I think it might have been some complicated negative DNS caching because I only added the LAN DHCP search domain later and tried to test it. I wouldn't have expected it be cache as switching back and forward between connections and one resolved and one didn't, on either connection it resolves to the same IP. – user1646448 Apr 15 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.