On a vanilla Ubuntu 18.04 headless server, the OpenVPN client is used to connect to a remote network in tap mode. The address, default gateway, DNS servers etc. are provided by a DHCP server on the remote network.
However, usage of the VPN-provided DNS servers seems to be not enforced. As
systemd-resolved is used as a stub resolver by default, this is the relevant output of
Global DNSSEC NTA: 10.in-addr.arpa 16.172.in-addr.arpa 168.192.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa corp d.f.ip6.arpa home internal intranet lan local private test Link 16 (tap1) Current Scopes: DNS LLMNR setting: yes MulticastDNS setting: no DNSSEC setting: no DNSSEC supported: no DNS Servers: 10.0.0.2 DNS Domain: foo.bar Link 2 (ens192) Current Scopes: DNS LLMNR setting: yes MulticastDNS setting: no DNSSEC setting: no DNSSEC supported: no DNS Servers: 192.168.0.1 DNS Domain: foo2.bar2
As you can see, both the DNS servers (from local network DHCP and VPN network DHCP) are present.
- How can I find out which DNS server is actually used by
systemd-resolved, using command line utilities?
- How can I enforce the usage of the VPN-provided DNS server for all requests? Theoretically, this should be possible by setting the DNS domain to
~., as by the
systemd-resolveddocumentation. However, with the complex interactions between
netplanand DHCP I was unable to override this setting.