Azure Virtual WAN P2S VPN - Access internal domain from Android or IOS

$@chin 380 Reputation points
2026-03-04T19:10:34.0566667+00:00

I have configured Azure Virtual WAN Point-to-Site VPN in Subscription A, and my application VM is hosted in Subscription B. Both VNets are connected through the Virtual WAN hub.

Current scenario:

P2S VPN is working correctly and able to access the VM internal endpoint

On Windows clients, usually add an entry in the hosts file like below to access the application using a domain name:

192.100.12.2 abc.com

This works fine on Windows.

Problem:
When connecting from Android devices (OpenVPN client), we cannot modify the hosts file. Because of this, the internal domain abc.com does not resolve.

Questions:

  1. If I do not have an internal DNS server, is there any way to resolve an internal domain for P2S VPN clients (Android or IOS) ?
  2. Can I configure the VM private IP (192.100.12.2) directly as a custom DNS server in the Virtual WAN P2S configuration ? or can do anything on the .ovpn config file ?
  3. If not, what would be the recommended approach in this scenario to allow Android/IOS VPN clients to access the internal site using a domain name instead of IP ?
Azure Virtual WAN
Azure Virtual WAN

An Azure virtual networking service that provides optimized and automated branch-to-branch connectivity.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Praveen Bandaru 11,720 Reputation points Microsoft External Staff Moderator
    2026-03-05T09:24:48.77+00:00

    Hello **$@chin**We would like to clarify how the internal application behaves when accessed through the Azure Point‑to‑Site VPN from various devices. Currently, VPN connectivity is functioning properly, and users can reach the application via its private IP address. On Windows devices, access using the domain name works because Windows allows manual host file entries to map the domain name to the private IP.

    On Android and iOS devices, modifying the hosts file is not supported, so they rely entirely on DNS for domain name resolution. Since there is no internal DNS service configured, these devices cannot resolve the internal domain name to the private IP address. This is a limitation of the platform, not the VPN connectivity.

    Azure Point‑to‑Site VPN does not offer a built‑in DNS service and setting the application VM’s private IP as a DNS server is not supported. Changing the VPN configuration file also does not allow static domain‑to‑IP mappings. To enable domain name access across all devices, a proper DNS resolution mechanism is necessary.

    Create an Azure Private DNS zone called abc.com, add an A record pointing to 192.x.x.x, and link that zone to your spoke VNet(s).

    And configure an internal DNS resolution service, such as Azure DNS Private Resolver. This allows VPN‑connected users, including Android and iOS clients, to securely resolve internal domain names. Once implemented, users will be able to access the application using the same domain name on Windows, Android, and iOS devices.

    Check the below document:

    https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview

    I hope the above answer helps you! Please let us know if you have any further questions.

    Please don't forget to "upvote" where the information provided will help you, this can be beneficial to other members of the community.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-03-04T19:10:54.49+00:00
    1. Without an internal DNS server, the only built-in options to influence name resolution for P2S clients in Virtual WAN are:
      • Configure DNS servers on the Virtual WAN P2S gateway, so the VPN profile advertises those DNS servers to clients.
      • For Windows clients using Azure VPN Client, optionally modify the downloaded profile XML to add custom DNS entries.
      For Android/iOS OpenVPN clients, there is no supported way in Virtual WAN to centrally push host-file–style overrides (for example, mapping abc.com directly to 192.100.12.2) without using a DNS server that can answer for that name. So, without an internal DNS server, there is no clean, supported way to make abc.com resolve differently only when connected over VPN on Android/iOS.
    2. The VM private IP (192.100.12.2) should not be configured directly as a DNS server in the Virtual WAN P2S configuration unless that VM is actually running a DNS service and is reachable from the P2S clients over the VPN. The P2S configuration expects valid DNS server IPs, not arbitrary endpoints. The documentation describes two supported ways to add DNS servers for P2S clients:
      • Use PowerShell to add custom DNS servers to the gateway (preferred, because it configures DNS at the gateway level rather than per client).
      • For Azure VPN Client on Windows 10, modify the downloaded profile XML and add <dnsservers><dnsserver>...</dnsserver></dnsservers> before importing it.
      These mechanisms assume the specified IPs are real DNS servers. They do not provide a way to embed static host mappings in the .ovpn file for Android/iOS in the Virtual WAN scenario.
    3. Recommended approach for Android/iOS clients to use a domain name:
      • Deploy a DNS server (for example, on a VM or as part of an existing DNS infrastructure) that:
        • Is reachable from the P2S address pool via the Virtual WAN hub and VNet connections.
        • Hosts a zone (for example, abc.com) and an A record pointing abc.com to 192.100.12.2.
      • Configure that DNS server’s IP address as a custom DNS server in the Virtual WAN P2S configuration using the supported method (PowerShell or profile configuration, depending on client type).
      • Regenerate and redistribute the VPN client configuration so Android/iOS OpenVPN clients receive the DNS server information from the Virtual WAN profile.
      This way, all P2S clients (Windows, Android, iOS, etc.) can resolve abc.com over VPN without modifying local host files.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.