I have an OpenVPN server to access an Amazon VPC. I have a bind DNS on that same VPN server for solving local names (say *.local.example.com) and for everything else, bind uses forwarders as google DNS.

My problem is that I would like to avoid having my VPN/local DNS receive every DNS queries and forward them (for most of the time) and cache them since it is not a powerful server.

My question here is whether I can make the VPN users query my local bind DNS for the local queries and use their own DNS (e.g. defined in their resolv.conf before they connect to the VPN) for all others by pushing some configuration with OpenVPN.

Server : Debian 8, OpenVPN and bind9


-- Edit --

To clear things a bit, here is my goal if possible :

A home user connects to OpenVPN server, which is also a local DNS (for only a set of private addresses). When the home user requests google.com, his query is directed to say When the request is for local.mycompany.com, the query goes to my OpenVPN server/DNS. All this, without using a client-side add-on (push it with OpenVPN ?)

All this is to avoid a unnecessary load of DNS queries on my small VPN server/DNS (that he will anyway forward to Google DNS).


'Split Horizon' DNS, if servers behind the VPC are on a different domain then it is 'split brain' anyway - DNSMasQ is your friend:


  • This would require to install dnsmasq on my clients' computers and I need to limit as much as possible client-side configuration (unless I misunderstood... ?). Anyway, 'Split Horizon DNS' is a keyword that might probably be of great use to me and thanks for the answer ! (and I'll upvote whenever I can)
    – Bamse
    Apr 7 '16 at 10:37
  • If your authoritative name server is on your local lan and not behind the VPC then I would go with dnsmasq server in that region and remove bind, - or change the DHCP scope of you VPC to include you own DNS server and add host entries for your AWS instances to your local server. - this is assuming your VPC has an internet gateway and you can configure the local dns to allow those clients to resolve
    – Sum1sAdmin
    Apr 7 '16 at 10:52
  • 1
    I tried to clarify my question in an update. The users have their own DNS configs (and my guess is that they all go google's). What'd be great is if OpenVPN could say : 'use VPN's local DNS for *.local.example.com and whatever else you want for the rest'
    – Bamse
    Apr 7 '16 at 11:16
  • After some research, I gave up trying to push this to my VPN clients. As said in the answer here, the only way is to use something such as DNSMasq on client-side, pre-configured (so not pushed by OpenVPN), which makes the setup all much more complicated in the case of a company. However, that is the best answer I received and surely a good one. Now, to finally answer my own question : I think it is impossible (at least currently) and one would need some plugin between OpenVPN and DNSMasq or use split-horizon DNS on a gateway for instance.
    – Bamse
    Apr 15 '16 at 6:37

I am not sure for what purpose the OpenVPN server will be used. If the goal is to achieve anonimity and hide your true IP, then this no option. The end users will be having DNS leaks.

That said,

you can add the following option to your OpenVPN server config:

push "dhcp-option DNS"
push "dhcp-option DNS"
push "dhcp-option DNS YourOpenVPNIP"

Configure your DNS server on the VPS to not forward any requests and you should be good to go.

Windows will be contacting the first provided DNS first etc.. (See: https://technet.microsoft.com/en-us/library/dd197552%28WS.10%29.aspx )

If you do not want to go any of the DNS traffic from your PC to Google DNS over the VPS. You might have to configre extra routes in your VPN config.

  • 1
    Anonymity is not an issue here, sure ! I should have said also : the VPN is a split-tunnel. It is used to access a private network in a VPC and nothing else, so OpenVPN only pushes the few private routes and does not replace the default gateway. I don't think I've actually tried what you propose but I also believe that a secondary DNS is used only when the first one does not answer (i.e. is down). A DNS that hasn't got the answer at all will still answer something but I might be mixing up everything so I'll give it a try ! However, that'll be tomorrow. Thanks for the reply.
    – Bamse
    Apr 7 '16 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.