I'm trying to use openvpn as client on centos 7. It works fine, but i cannot get DNS from server. As you know, there is no resolvconf in new Centos, so, standard update-resolv-conf script doesn't work.

I rewrite it slightly:

# Parses DHCP options from openvpn to update resolv.conf                                                                                        
# To use set as 'up' and 'down' script in your openvpn *.conf:                                                                                  
# up /etc/openvpn/update-resolv-conf                                                                                                            
# down /etc/openvpn/update-resolv-conf                                                                                                          
# Used snippets of resolvconf script by Thomas Hood                                                                        
# and Chris Hanson                                                                                                                              
# Licensed under the GNU GPL.  See /usr/share/common-licenses/GPL.                                                                              
# 07/2013 colin@daedrum.net Fixed intet name                                                                                                    
# 05/2006 chlauber@bnc.ch                                                                                                                       
# Example envs set from openvpn:                                                                                                                
# foreign_option_1='dhcp-option DNS'                                                                                              
# foreign_option_2='dhcp-option DNS'                                                                                              
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'                                                                                               
# foreign_option_4='dhcp-option DOMAIN-SEARCH bnc.local'                                                                                        

set -e

## You might need to set the path manually here, i.e.                                                                                           
# RESOLVCONF=/usr/bin/resolvconf                                                                                                                
#RESOLVCONF=$(which resolvconf)                                                                                                                 
#[ -x $RESOLVCONF ] || exit 0                                                                                                                   

#IPv4 ONLY!                                                                                                                                     
NMCLI=/usr/bin/nmcli #$(which nmcli)                                                                                                            
SYSTEMCTL=/usr/bin/systemctl #$(which systemctl)                                                                                                

[ -x $NMCLI ] || exit 0
[ -x $SYSTEMCTL ] || exit 0

#testing version for running from console                                      
active_con_dev=$($NMCLI -t -f NAME,DEVICE con show --active | grep "tun" | head -1)
#it must be something like                                                                                                                      
#active_con_dev=$($NMCLI -t -f NAME,DEVICE con show --active | grep "$dev" | head -1)                                                           
active_con=$(echo $active_con_dev | awk '{print $1}' FS=":")
active_dev=$(echo $active_con_dev | awk '{print $2}' FS=":")


case $script_type in

   #we take first active connection and device (but not tun devices. I don't know either NM can show it or no)                                  

    for optionname in ${!foreign_option_*} ; do
      echo $option
      part1=$(echo "$option" | cut -d " " -f 1)
      if [ "$part1" == "dhcp-option" ] ; then
         part2=$(echo "$option" | cut -d " " -f 2)
         part3=$(echo "$option" | cut -d " " -f 3)
         if [ "$part2" == "DNS" ] ; then
         if [[ "$part2" == "DOMAIN" || "$part2" == "DOMAIN-SEARCH" ]] ; then
            IF_DNS_SEARCH="$IF_DNS_SEARCH $part3"
   for DS in $IF_DNS_SEARCH ; do
#           R="${R}search $DS"                                                                                                                  
   for NS in $IF_DNS_NAMESERVERS ; do
#           R="${R}nameserver $NS"                                                                                                              
   echo "$R" > "$dns_list_file"

   #ipv4 only                                                                                                                                   
   #we must check existence of DNS, but I'm too lazy now                                                                                        
   $NMCLI con mod $active_con +ipv4.dns "$R"
   $SYSTEMCTL restart NetworkManager
   #echo -n "$R" | $RESOLVCONF -p -a "${dev}"                                                                                                   
   #echo -n "$R" | $RESOLVCONF -a "${dev}.inet"                                                                                                 

   dns_list=$(echo "$dns_list_file")

   if [ ! -z "$dns_list" -a "$dns_list" != " " ]; then
          #we must check existence of this dns, but I'm too lazy now                                                                            
          $NMCLI con mod $active_con -ipv4.dns "$dns_list"
          $SYSTEMCTL restart NetworkManager

   #$RESOLVCONF -d "${dev}.inet"                                                                                                                

I don't sure about search servers, but in case of nameservers only it works. Again, it must be tested with multiple servers (i didn't do it).

So, it can add DNS to your connection. But it does not work with SElinux when you run it from systemctl (systemctl start openvpn@config.service). There are such strings in /var/log/audit.log:

type=AVC msg=audit(1414759817.198:2963): avc:  denied  { execute } for  pid=1827 comm="update-resolv-c" name="systemctl" dev="dm-1" ino=787169 \
scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file

I must write policy for SElinux. Ok, but is there some more user friendly way to set up DNS? May be maintainers of packages and developers of RedHat/Centos thought about openvpn DNS, but i don't know about it?

  • Where did you get this script? OpenVPN has no problems to edit the resolv.conf file by itself. Oct 31, 2014 at 10:29
  • I get it in archwiki. Same script is used in Ubuntu. No, it doesn't work. I have added script-security 2 in config, but there is no my dns in resolv.conf.
    – ckorzhik
    Oct 31, 2014 at 10:48

1 Answer 1


Try this commands:

$ mkdir /etc/openvpn/scripts
$ mv /etc/openvpn/update-resolv-conf /etc/openvpn/scripts/
$ restorecon -v /etc/openvpn/scripts/
$ restorecon -v /etc/openvpn/scripts/update-resolv-conf
$ setsebool openvpn_run_unconfined on
$ nano -w /etc/openvpn/config.conf
up /etc/openvpn/update-resolv-conf                                                                                                            
down /etc/openvpn/update-resolv-conf
script-security 2
$ systemctl start openvpn@config.service
$ systemctl status openvpn@config.service

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.