Microsoft Outlook (365) doesn't work when OpenVpn Client connected full-tunnel

I have a user who connects to the office using OpenVpn client in full tunnel mode. When they try to use Microsoft Outlook, when connected to the VPN, Outlook doesn't send or receive emails. I found a workaround by manually, inputting a DNS server in the TAP adapter for the client. When I manually add the DNS and click OK, Outlook starts working normally. However, when client disconnects from VPN, it will have same failure behavior until you manually put in a DNS server and click OK. It doesn't matter what DNS server address you put in, it will work after you click on the OK. Has anyone came across this before, or, have a better solution to this?

Office 365 will not authenticate if it detects VPN. It's a safeguard in the Office verification.

I had that issue as well. I found that if you connect to openvpn then wait a few minutes before attempting to open outlook, it works fine. I know this isnt a fix but its how I dealt with it before moving to wireguard.

I've not seen this, Outlook just uses whatever Internet connection it's got. Though admittedly I've not attempted to test this with a large geographic disparity between the VPN termination point and Outlook.

I would be curious to know if this issue happens with 2FA enabled on M365. But the OPs issue appears to be a DNS resolution problem, or an issue with TCP/IP. Putting IP addresses into any of the fields on the screen with the DNS addresses causes a winsock reset. I'll bet it's the reset that's "fixing" things temporarily.

I would suggest simply pushing working DNS details instead.

I just ran into this problem at one of my larger clients. It appears that Outlook won't authenticate due to the missing gateway on the tunnel adapter. I'm in the process of trying workarounds, reg hacks, etc.

I discovered one workaround that isn't too cumbersome to deal with. I simply added the OpenVPN gateway IP address to the TAP Adapter's default gateway (IPv4 > Advanced > IP Settings > Default Gateway). It's persistent between connections and Outlook seems to authenticate reliably now.

Based on my findings, I'm going to guess that most aren't using full-tunnel configs.

The difference between full tunnel, and split tunnel is that gateway.

If it's empty, it's split tunnel.

Quote:

---

Originally Posted by sky-knight

If it's empty, it's split tunnel.

---

It's empty either way.