9

When I run openconnect (with the default vpnc script) it changes /etc/resolv.conf and it really shouldn't do that. I am just using the VPN for a few specific host not for a full Internet connection.

4

Use vpn-slice to set up a split tunnel connection wherein your DNS configuration is not modified, and only traffic to a few hosts or IP subnets is routed over the VPN.

It was created for this exact purpose:

I am just using the VPN for a few specific host not for a full Internet connection.

Once you've installed vpn-slice, use it with OpenConnect as a replacement for the standard vpnc-script (you can remove the -v --dump after you've confirmed that it's working properly):

$ openconnect --script "vpn-slice -v --dump host.you.need.to.access some.other.host" \
   vpn-server.your.company.com

This will set the routing tables up so that only traffic to those two particular hosts are routed over the VPN, and will add entries for them to /etc/hosts. Docs have more details.

(I'm the author of vpn-slice, and one of the main contributors to OpenConnect.)

  • 2
    Thanks for your contribution! This question predates vpn-slice by quite a few years but it's great such a tool is available now! – chx May 1 '20 at 22:23
  • 2
    This is exactly what I was looking for, thank you! Also now my machine doesn't dump my ssh session when logged into the VPN either. – cherno Jun 17 '20 at 4:27
  • Very handy solution! – 1111161171159459134 Aug 7 '20 at 10:22
10

Create the following script /etc/vpnc/no_resolverupdate.sh

#!/bin/sh
#
#
export INTERNAL_IP4_DNS=

. /usr/share/vpnc-scripts/vpnc-script

Make it executable:

chmod +x /etc/vpnc/no_resolverupdate.sh

Then add a line to your connection configuration file (here /etc/vpnc/customer.conf)

echo 'Script /etc/vpnc/no_resolverupdate.sh' >> /etc/vpnc/customer.conf
  • This deserves to be the preferred response because It gives a fix and not only an explanation. – Luis Vazquez Aug 22 '18 at 20:44
  • 1
    I would add two extra fixes I had to do in order to make this solution work in RedHat based (RHEL/CentOS/Fedora/Mageia) distributions: 1. the path of the vpnc-script at the end of the no_resolverupdate.sh has to be changed to /usr/sbin/vpnc-script 2. accoding to the manual pages for my openconnect version, the configuration line to execute the custom script had to be changed to "script=/etc/vpnc/no_resolvconf.sh" – Luis Vazquez Oct 14 '18 at 16:49
  • Just a note for the vpnc-script modification method. Openconnect will generate a dns configuration file under /etc/resolvconf/run/interface/, so if you find the DNS still changes after applying the hack, you might need to clean the configuration file here. The file name should be the name of the tunnel device. – hajimuz Oct 23 '19 at 10:40
7

Does vpnc-script look like this? If so, the belows code is why it changes your /etc/resolv.conf:

if [ -x /sbin/resolvconf ]; then # Optional tool on Debian, Ubuntu, Gentoo
    MODIFYRESOLVCONF=modify_resolvconf_manager
    RESTORERESOLVCONF=restore_resolvconf_manager
elif [ -x /sbin/modify_resolvconf ]; then # Mandatory tool on Suse earlier than 11.1
    MODIFYRESOLVCONF=modify_resolvconf_suse
    RESTORERESOLVCONF=restore_resolvconf_suse
else # Generic for any OS
    MODIFYRESOLVCONF=modify_resolvconf_generic
    RESTORERESOLVCONF=restore_resolvconf_generic
fi

modify_resolvconf_manager() {
    NEW_RESOLVCONF=""
    for i in $INTERNAL_IP4_DNS; do
        NEW_RESOLVCONF="$NEW_RESOLVCONF
nameserver $i"
    done
    if [ -n "$CISCO_DEF_DOMAIN" ]; then
        NEW_RESOLVCONF="$NEW_RESOLVCONF
domain $CISCO_DEF_DOMAIN"
    fi
    echo "$NEW_RESOLVCONF" | /sbin/resolvconf -a $TUNDEV
}

The 'dirty' way is make the /etc/resolv.conf file immutable:

# chattr +i /etc/resolv.conf

The proper way is edit your vpnc-script to make it shouldn't change the /etc/resolv.conf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.