0

On a vanilla Ubuntu 18.04 headless server, the OpenVPN client is used to connect to a remote network in tap mode. The address, default gateway, DNS servers etc. are provided by a DHCP server on the remote network.

However, usage of the VPN-provided DNS servers seems to be not enforced. As systemd-resolved is used as a stub resolver by default, this is the relevant output of systemd-resolve --status:

Global
          DNSSEC NTA: 10.in-addr.arpa
                      16.172.in-addr.arpa
                      168.192.in-addr.arpa
                      17.172.in-addr.arpa
                      18.172.in-addr.arpa
                      19.172.in-addr.arpa
                      20.172.in-addr.arpa
                      21.172.in-addr.arpa
                      22.172.in-addr.arpa
                      23.172.in-addr.arpa
                      24.172.in-addr.arpa
                      25.172.in-addr.arpa
                      26.172.in-addr.arpa
                      27.172.in-addr.arpa
                      28.172.in-addr.arpa
                      29.172.in-addr.arpa
                      30.172.in-addr.arpa
                      31.172.in-addr.arpa
                      corp
                      d.f.ip6.arpa
                      home
                      internal
                      intranet
                      lan
                      local
                      private
                      test

Link 16 (tap1)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 10.0.0.2
          DNS Domain: foo.bar

Link 2 (ens192)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 192.168.0.1
          DNS Domain: foo2.bar2

As you can see, both the DNS servers (from local network DHCP and VPN network DHCP) are present.

  • How can I find out which DNS server is actually used by systemd-resolved, using command line utilities?
  • How can I enforce the usage of the VPN-provided DNS server for all requests? Theoretically, this should be possible by setting the DNS domain to ~., as by the systemd-resolved documentation. However, with the complex interactions between systemd-resolved, systemd-networkd, netplan and DHCP I was unable to override this setting.
0

I have figured out a solution for my 2nd question:

  1. Remove any netplan configurations for the tap device, then run netplan apply. Netplan configurations always override custom systemd-networkd configurations, but they don't provide the necessary options we need.
  2. Add a systemd-networkd configuration, for instance in /etc/systemd/network/tap1.network:

    [Match]
    Name=tap1
    
    [Link]
    RequiredForOnline=no
    
    [Network]
    DHCP=ipv4
    LinkLocalAddressing=ipv6
    Domains=~.
    
    [DHCP]
    UseMTU=true
    RouteMetric=100
    UseDomains=false
    
  3. Restart the VPN session

Now systemd-resolved uses ~. as the DNS domain as intended. Key elements are the [Network] Domains=~. and [DHCP] UseDomains=false of the systemd-networkd configuration.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.