I've been conducting a detailed evaluation of NordLayer's Windows client (version 3.14.0) against a set of organizational requirements that mandate the use of Cisco Umbrella (OpenDNS) as our resolver for DNS filtering and logging. Despite following the documented procedure, the client persistently overrides my system's DNS settings with NordLayer's own resolvers, breaking our security policy.
I have attempted the following configuration sequence, which aligns with their knowledge base articles:
1. **Configured the `config.ini` file** located in `%ProgramData%NordLayer`.
```ini
[DNS]
dns=1
custom_dns_ips=208.67.222.222, 208.67.220.220
```
2. **Enabled the "Custom DNS" toggle** within the client application GUI *before* connecting.
3. **Verified Windows DNS settings** pre-connection were correctly set to Umbrella servers.
4. **Initiated connection** to our designated gateway.
Upon connection, the Windows interface adapter shows the DNS servers have been changed to `103.86.96.100` and `103.86.99.100` (NordLayer's DNS). The `config.ini` file remains unchanged post-connection. This suggests the client is either not reading the configuration correctly or possesses a logic flaw that prioritizes its own DNS provisioning over the user-defined setting.
My diagnostic steps thus far:
* Verified no group-level DNS policies are enforced in the NordLayer admin panel (it's set to 'None').
* Examined Windows Event Viewer logs for related errors (none found).
* Ran the client with Windows command prompt logging: `nordlayer.exe --log-level=debug`. The output was verbose but inconclusive on the DNS override rationale.
* Tested with both split-tunneling enabled and disabled. The DNS override occurs in both scenarios.
This is a significant operational blocker. The core function of a business VPN in our context is to provide network-level access *while* adhering to our centralized DNS security layer. Defeating that layer nullifies a primary security control.
**Key Questions for the Community:**
* Has anyone successfully configured a third-party security DNS (Umbrella, Cloudflare Gateway, NextDNS) with the NordLayer Windows client?
* Are there undocumented registry keys or alternative configuration file parameters that govern this behavior?
* Is this a known limitation with their current client architecture? I am aware that some VPN providers implement their DNS at a kernel level, making user-space overrides impossible.
* For those who have encountered this, were any workarounds effective? I am considering forcing DNS via a local DNS proxy (like dnsmasq on WSL2) or a host-based firewall rule redirecting port 53, but these are suboptimal solutions.
I will be instrumenting further tests with Wireshark to confirm the exact point of DNS request routing. Any shared experiences or data points would be valuable for my analysis.