Comment by thayne
2 days ago
Another big problem with split-horizon is you can get clients that cache the dns result before connecting to the vpn, then after connecting, can't actually use the service, because it is using the public ip instead of the private one.
Just use IPv6: no "internal" (10/8) or "external" address, just an address. ;)
> because it is using the public ip instead of the private one.
For this edge case, the issue is not with DNS; it's that the router is not configured to allow internal clients to access the network through the public IP, vis-à-vis hairpin routing.