Local Devices Not Reachable via VPN – Troubleshooting Guide

Variance in ping times can be indicative of several things, but the fact that you get the same behaviour regardless of which server in that data centre you ping seems to indicate that there may be an issue with a link or device along the path.

It's worth doing repeated traceroutes to the sever(s) in question, to see if you can identify a particular network device where latency is varying; or alternatively, it could be that there are multiple paths to this location, one of which experiences generally higher latency.

Are you seeing any packet loss when you perform extended pings? If so, this may be indicative of a congested link.

Could you provide a bit more detail about the connectivity between your office and your data centres? Are you using leased lines? Internet VPN? Have you spoken to your company's NOC/network administrators? They may be aware of this issue already.

When your VPN is disconnected, your client's resolver uses your home DNS server to resolve names. When you try to access the hostname router, it uses the search path and asks your server for the address of router.dailey.home.com, and all is well.

When your VPN is connected, your VPN client and network settings point your client's resolver to your work DNS server. When you try to access the hostname router, your computer asks your work DNS server for the address of router.dailey.home.com. Since, as you've noted, the authoritative servers for the home.com domain return a valid answer for that domain name, the resolver stops there. If, instead, you changed your domain name to something not resolvable by Internet DNS servers, such as home.local, your work DNS server would still have no way of resolving router.home.local to an IP address, and would likely return an authoritative NXDOMAIN answer, i.e. "this domain does not exist." This configuration would fix your inability to reach intranet hosts without fully qualified names, since your client would proceed to the next element of your search path, but you still wouldn't be able to reach your home machines.

The best solution I can think of is to set up your client to prefer your Local Area Connection 2 (Control Panel > Network and Internet (View network status and tasks)> Change adapter settings; press Alt and choose Advanced Settings; and then modify the adapter order), and then to configure your DNS server to delegate responsibility for the pacs.local domain to your work DNS server. This arrangement still has the problem that you won't be able to get to any Internet-facing machines in pacs.local when your VPN is not connected, but given that the TLD is .local, I expect that won't be a problem. You may possibly still run afoul of requirements from your VPN client.