Cannot Connect to Web App from my VPN Gateway

Question

Cannot Connect to Web App from my VPN Gateway

Application Admin 0

I am getting a ERR_NAME_NOT_RESOLVED error when trying to access my Azure Web app thats on a private endpoint using my VPN Gateway.

Note that I am able to access the Web app through my VM that's on the same VNet as the Web App.

May web app and VPN Gateway are on the same VNet and have there own individual SubNets. I have no NSG applied or firewalls and my Azure VPN Client is connected. Also all my DNS configurations look good as I'm able to connect via my VM.

Also note I'm using Point to Site with OpenVPN with Entra ID and Route-based as a VPN-type. Any assistance would be much appreciated as I seems its a DNS resolution issue but I can't identify the exact issue. Thank You

1 answer

Your answer

Answer 1

Hi @Application Admin,

Thank you for reaching out on Microsoft Q&A forum.

The error "ERRNAMENOT_RESOLVED" when accessing your Azure Web app via a Point-to-Site VPN Gateway with a private endpoint is a common DNS resolution issue. While your VM within the VNet can resolve the private endpoint via the private DNS zone, P2S VPN clients do not always resolve to the private DNS zone automatically.

This typically happens because VPN clients may not be using the Azure private DNS or custom DNS forwarders configured for your VNet. To resolve this, ensure your VPN client is configured to use the DNS servers that can resolve privatelink.azurewebsites.net zones. Options include:

Configuring DNS forwarding on a VM or Azure DNS private resolver in the VNet, linked to your VPN client configurations.
Adding appropriate DNS server IPs to the VPN client DNS settings.
As a workaround, editing the hosts file on the VPN client with the private IP of the private endpoint.

Please verify the following:

Does the VPN client’s DNS setting point to your Azure VNet DNS or custom DNS forwarder?
Are the private DNS zones for privatelink.azurewebsites.net linked to your VNet hosting the web app and VPN Gateway?
When running nslookup on the VPN client machine for your web app's domain, does it resolve to the private IP address?
Have you tested DNS forwarding or proxy solutions that Azure recommends for VPN clients accessing private endpoints?

For more guidance, see Microsoft's troubleshooting for private endpoint DNS resolution with VPN:

Please share details on your VPN client DNS configuration and results from DNS resolution tests performed on the VPN client. This will help narrow down if the issue lies with DNS forwarding, VPN client configuration, or private DNS zone linking.

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,

Thanmayi

Application Admin 0 Reputation points

2025-11-25T05:24:45.15+00:00

Hello Thanmayi,

Yes the DNS Server points to my custom DNS Server IP (Inbound Endpoint from DNS private resolver)

Yes my privatelink.azurewebsites.net private DNS zone is linked to the same VNet as my web app and VPN Gateway.

The nslookup does not resolve to the private IP address. It just returns the below: Server: Unknown Address: 2001:558:feed::1 *** UnKnown can't find <webappname>.privatelink.azurewebsites.net: No response from server

Yes I have used the opstergo referenced link and set up a Private DNS Resolver and updated my DNS server to Custom and confirmed the updated on my new VPN client profile.

After all these steps I still get the same error ERR_NAME_NOT_RESOLVED when trying to access the app with the VPN Gateway. Any other ideas?

Thank You

Stanley
Thanmayi Godithi 2,215 Reputation points Microsoft External Staff Moderator

2025-11-25T10:13:04.82+00:00

Hi @Application Admin,

Thank you for sharing the asked information.

Since you mentioned that you are using a custom DNS server the issue might be with how the Private DNS Resolver is set up or configured.

Use the below link and check if your congigurations are correct or not.

https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-get-started-portal

If any of these steps are missing or not configured correctly, your VPN client won’t resolve the private endpoint name, causing the ERR_NAME_NOT_RESOLVED error

Additionally to test if the issue is with DNS resolver,try the below steps:

Try changing the host file of your local machine with FQDN and IP address of your app service private endpoint.You can find FQDN,IP adress in the Azure portal for your Web app endpoint.

Switch to Azure DNS

Now try to connect and confirm if that works.

Let me know if the above helped or if you need further assistance.

Thanks,

Thanmayi

Share via

Cannot Connect to Web App from my VPN Gateway

1 answer

Your answer