Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have defined an ubnound DNS server on my VPS and it appears to work. I need to use the DNS server instead of Public DNS IPs because some ISPs have blocked public DNS IPs. My openvpn.conf file is:

    dev tun
    proto tcp

    # Notice: here I set the listening port to be 80 to avoid possible port blockage
    port 80

    ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
    cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
    key /etc/openvpn/easy-rsa/2.0/keys/server.key
    dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

    user nobody
    group nogroup


    #status openvpn-status.log
    #verb 3

    push "redirect-gateway def1"

    #pushing public DNS IPs

    push "dhcp-option DNS"
    push "dhcp-option DNS"


As it is suggested here, I tried to use my server's IPs (say So instead of

    push "dhcp-option DNS"
    push "dhcp-option DNS"

I just put

push "dhcp-option DNS"

In openvpn.conf above. However, after restarting openvpn, I see that my client can still connect to the OpenVPN server but no pages can be rendered anymore.

What can be wrong here? How can I solve this problem?

share|improve this question

You say that the "it appears to work." How did you verify this? Are you basing it on the fact the server started without any errors or did you actually perform some queries against it?

First thing I would do is use nslookup or dig to connect to the unbound server and perform some queries. I know dig is more in fashion these days but I know nslookup better.

$ nslookup
> server
Default server:
> set type=A

Non-authoritative answer:  canonical name =

If this does not work then you have to look back at the DNS configuration again.

Is this a primary DNS server or a caching DNS server? Are you trying to query local resources or internet resources? Does it work as expected if you do not push your DNS server to the client?

If you pass all your traffic through your OpenVPN server you should not need to worry about your ISP blocking public DNS servers anymore since as far as your ISP is concerned you are only generating traffic to your VPS; unless the VPS is behind the same ISP.

share|improve this answer
Well ubound could pass all the tests that you mentioned and some more so I'm pretty sure that it is not the problem. As for why I need to use my own DNS server, I have experienced that when I use public DNS as above, the clients in Iran (where millions of sites are blocked) can not get any page through their openvpn connection, despite the fact that they can connect to the openvpn server. Hence the effort. Thanks – hbp Oct 5 '11 at 18:14
Have you confirmed that they can get a webpage via IP address once they are connected? This would just make sure it really is DNS problem and not a routing issue. Its very common when setting up OpenVPN to be able to connect to the server but not get any traffic back due to a missing return route. – digitaladdictions Oct 5 '11 at 20:14

It turns out that if you are trying to connect from a non-Windows client, you need to do a couple of extra steps:

On Linux

Put this line on your client configuration (client.conf or xxxx.ovpnfile)

dhcp-option DNS

Call the OpenVPN client in this way:

$ openvpn --script-security 2 --config xxxx.ovpn

That worked for me.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.