So to the best of my understanding, I have all the pieces, namely, DNSmasq and OpenVPN working fine, although independently. What I've done?

  • Installed OpenVPN using this: https://github.com/Nyr/openvpn-install
    • After install, I'm able to connect client (PC, phone), works. No issue.
  • I've installed DNSmasq and also appears to be running and working as expected
    • I've blocked one or two sites i.e pointed them to in the /etc/hosts file, and when I do nslookup thatdomain.com, I get the response

This is currently my /etc/openvpn/server/server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
verb 3
crl-verify crl.pem

And the only change I've made to the default /etc/dnsmasq.conf file is uncommenting and indicating the interface this line:


Where I need help?

How to make OpenVPN use DNSmasq for all DNS requests. I just can't seem to find a definite answer on how to achieve that, which of the files to change, and what to add.

Am I missing any steps?

Edit: With the above conf, when I ssh into the openvpn server (the dnsmasq runs also on same server), and I do

nslookup google.com, it resolve correctly

When I do nslookup blockthis.com it resolves correct to as expected, as per outlined in the /etc/hosts file.

Problem is, when I connect from client to the openvpn, somehow the openvpn isn't handing over the dns resolution to dnsmasq, yet the line interface=tun0 is enabled in the dnsmasq, and a netstat -plunt indicates port 53 is up and running, listened by dnsmasq.

  • 1
    What are and If you are running dnsmasq on the same host as the openvpn server, you should probably use push "dhcp-option DNS" instead. (It does not guarantee that all the clients can / will only use it as the DNS server though, for that you probably need some port-based traffic redirection.)
    – Tom Yan
    Sep 12 '21 at 5:44
  • The is DNS IP address for AdGuard. Yes, I'm running Dnsmasq on the same host with the OpenVPN server. They both on a single VPS.
    – KhoPhi
    Sep 12 '21 at 8:12
  • You should configure dnsmasq to use them as its upstream servers.
    – Tom Yan
    Sep 12 '21 at 9:04
  • @TomYan I think I have already. When I run sudo service dnsmasq status, I get one of the lines saying, using nameserver Yet when I connect to the VPN, no request works, and DNS resolution doesn't work
    – KhoPhi
    Sep 12 '21 at 10:09
  • Then update your question, with the current configuration
    – djdomi
    Sep 12 '21 at 12:28

Okay, got it resolved. Needed to open Firewall.

ufw allow out on tun0

ufw allow in on tun0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.