12

Our Linux Ubuntu configuration does have a DNS server (Bind 9).
And resolv.conf has its

  nameserver 127.0.0.1

When using openvpn client on that Linux, the nameserver is not changed (by the VPN server) but I would like to set it - only during the VPN session - to another specific DNS server x.y.z.t, by changing the openvpn client config.

Then, when the openvpn session ends, nameserver should be back to 127.0.0.1.

Is there a "clean" way (ie a line in the openvpn client config file) to do that?

(Note: The VPN server config cannot be changed)

5 Answers 5

18

After more googling, could find the answer - below if it can help someone.

  • install resolvconf which can save and restore the resolv.conf config file
  • add a script to be run by openvpn, in /usr/share/openvpn, named update-resolv-conf. The script determines what should be the new resolv.conf, and how to restore it (see link below)
  • add

these lines

  script-security 2
  up /usr/share/openvpn/update-resolv-conf
  down /usr/share/openvpn/update-resolv-conf

in the openvpn client config file.

Read on this wiki for more information.

3
  • 7
    Newer installs of OpenVPN include this script with the installation. Instead of manually downloading and installing at /usr/share/openvpn/update-resolv-conf, you can find it pre-installed at /etc/openvpn/update-resolv-conf. Jun 18, 2018 at 23:26
  • Which version of OpenVPN started to include this file?
    – lanoxx
    Aug 26, 2018 at 13:39
  • 1
    A bit late to the party here but I'm using 2.4.6 and it's been installed for me Dec 22, 2019 at 20:26
5

2022 update (Arch Linux)

To set a public dns server and update resolvconf, add the following to your ovpn client profile file:

dhcp-option DNS 1.1.1.1
script-security 2
up /usr/share/openvpn/contrib/pull-resolv-conf/client.up
down /usr/share/openvpn/contrib/pull-resolv-conf/client.down
1
1

Consider using route-up / route-down scripts on your client to alter your configuration on connection setup as you see fit. See the OpenVPN docs on details for how to set this up and which variables you might use in these scripts.

3
  • +1, interesting and useful. The resolvconf solution via up and down (above or below dep. on rating..) is however more to the point, and, imo, cleaner.
    – Déjà vu
    Apr 23, 2014 at 6:31
  • @ring0 I would advise using route-up instead of up to minimize race conditions. When the up script is executed, the connection is not yet set up and you have no chance to query the remote resolver you're setting. If you start the OpenVPN client in a situation where the connection setup would not complete, you are putting your resolver into a possibly non-functional state for a prolonged period of time. See the "Script Order of Execution" section in the OpenVPN man page for details.
    – the-wabbit
    Apr 23, 2014 at 8:11
  • I did a few tests, and the up script is called right when "Initialization Sequence Completed" is reached, not before. Btw cannot find "route-down" in the man.
    – Déjà vu
    Apr 23, 2014 at 15:19
1

This was useful information in order to help me fixing this issue.

I'm an arch linux user and what I saw is that when a Linux client is used with Access Server, this one is unable to alter the DNS settings on the client in question not resolving host as it the stands on OPEN VPN Documentation

I created a script which fixes the problem and with a couple of extra parameters handles openvpn connections via command line.

https://gist.github.com/android10/ee5c3e93dbcf9b7b31e6ee768cbfd477

Here is the main command being executed for the connection:

  nohup openvpn --config $OVPN_FILE_PATH --askpass $OVPN_PRIVATE_KEY_FILE_PATH \
  --script-security 2 \
  --setenv PATH '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' \
  --up /etc/openvpn/scripts/update-systemd-resolved \
  --down /etc/openvpn/scripts/update-systemd-resolved \
  --down-pre \
  &>/dev/null &

Any feedback is more than appreciated it.

-3

echo "nameserver=w.x.y.z" > /etc/resolv.conf
echo "nameserver=127.0.0.1" >> /etc/resolv.conf

2
  • 2
    That seems inexact (think about the DNS search path, and the persistence of the VPN nameserver), but it's also unclear where you want him to put this. Aug 18, 2014 at 6:54
  • 1
    There should be a space between 'nameserver' and the IP.
    – lorenzog
    Mar 12, 2017 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .