When is domain resolved for openvpn server?

Question

In my setup I have several OpenVPN clients pointing to a vpn server's dns name. let's use vpn1.mydomain.com as an example. The server's public IP pointed to by that domain would be for example 123.45.67.89

Now I change the DNS record and point the vpn1.mydomain.com domain to another IP, for example 98.76.54.32.

My question is, when is the DNS lookup performed by clients to resolve the new IP for OpenVPN, and how can I trigger a lookup to make clients use the new IP? Do I need to restart service on clients, on server or is there some way to flush dns cache and make client open new connection to new IP?

Note: I am aware that using domain names may not be considered best practices for this kind of setup, and that using the IP directly might be preferred by some.

Answer 1

My question is, when is the DNS lookup performed by clients to resolve the new IP for OpenVPN

When the connection is first established.

how can I trigger a lookup to make clients use the new IP?

This varies depending on OS. If your users are using OSX, for example, $ dscacheutil -flushcache will flush the local cache. Other OSes have similar commands. After flushing the cache, disconnect/reconnect OpenVPN.

However...

DNS records are cached at many different levels (host OS, ISP resolver, etc.), many of which you have no control over. The best you can do is lower the TTL on the record to as low as you can in advance of the change, then make the change, keeping the old server up until it stops receiving OpenVPN connections. If you have stubborn connections that won't move to the new IP, then just kick them off of the server and force the issue.

Note: I am aware that using domain names may not be considered best practices for this kind of setup, and that using the IP directly might be preferred by some.

Nah, this is exactly what you should do. Using a DNS name here makes IP changes much easier.