I have an openVPN server using a routed TUN setup.


topology subnet
push "redirect-gateway"
push "route"
push "dhcp-option DNS"    

I'm having trouble with my openVPN client and access to an intranet web server. The domain name for the web server is intranet.app.

Access from the LAN is working fine - the gateway forwards DNS queries for intranet.app to the local server.

When I connect via openVPN it seems as if all DNS queries are forwarded to the DNS server listed by the Wireless / LAN adaptor used to connect to the internet. If that DNS query doesn't resolve - it then queries the DNS server listed on the vpn gateway.

I have tested this by setting up a dummy domain on my server as intranet.lan.

intranet.app - resolves to because .app is now a gTLD but intranet.app isn't a registered domain.

intranet.lan - doesn't resolve because .lan isn't a gTLD. The vpn gateway DNS server is then queried and query does resolve to the LAN hosted web server.

How can I programmatically make sure that the openVPN client only sends DNS queries to the VPN gateway and not the Wireless / LAN adapter??


  • Programmatically at which end of the connection?
    – womble
    Sep 4 '15 at 10:56
  • Preferably something within server.conf. I have just found a script on dnsleaktest.com that works on the client side. It basically removes the dns servers listed for the existing connections and then adds the openVPN server DNS addresses once connected. Looks good but I would like to know if this is something that can be achieved from within openVPN.
    – Gavin
    Sep 4 '15 at 11:10
  • Well, your client-side script is "within OpenVPN", just on the client-side. There's nothing the server can do to force the client to behave a certain way, though, if the client doesn't want to.
    – womble
    Sep 4 '15 at 11:11
  • I just thought it was something achievable by providing the routes in the server.conf and maybe I had something setup wrong.
    – Gavin
    Sep 4 '15 at 11:14
  • It isn't a routing issue, it's a DNS resolver configuration issue on the client. If OpenVPN had an option on the client to say, "nuke all your existing DNS resolver configuration", you could push that from the server, but I'm not seeing one in the manpage.
    – womble
    Sep 4 '15 at 11:21

I have found a set of scripts at dnsleaktest.com which removes any existing links to DNS resolvers before the tunnel is created and adds those of the VPN connection. It also reverses this once the connection is closed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.