I recently installed Kali Linux on VMWare. I was able to successfully install openVPN following these instructions, but it seems that it does not pass the DNS Leak test. Is there anything that can fix that?

Also, how can I stop my internet connection if my VPN fails? I do not want to expose my real IP.

  • What is the "DNS test"?
    – casey
    Apr 23, 2015 at 20:31
  • I tried the DNS Leak test, check here: dnsleak.com
    – user01230
    Apr 23, 2015 at 20:32
  • In addition to @ysdx man openvpn is always a good place to start. Write a config file too so you can just run openvpn conf.ovpn as root. Basically you want to use the --route-up cmd, --up cmd, --down-pre cmd, etc to run custom scripts, and --route network/IP [netmask] [gateway] [metric] which will tear down the routes automatically in reverse order when the conn closes. All these cmd-line directives can be put in a config file also once it works. Sounds like your not routing properly. May 12, 2015 at 20:18
  • Also, you can use iptables to block all egress traffic except destined to you VPN provider or proxy. If your really paranoid, you can try connecting to your VPN from behind a whonix vm. The VPN must be TCP, and it would probably be best to do it from within a VM with Kali configured as a workstation for the whonix gateway. Don't expect any solution to protect you against the NSA or anything like that. May 12, 2015 at 20:35

3 Answers 3


By default, OpenVPN does not reconfigure the DNS on non-Windows. You could use a hook (sorry the explanations are in French) in order to do this:


# Write foreign options to stdout:
foreign_options() {
   local i
   while true; do
       local varname=foreign_option_$i
       local value="$(eval echo \$$varname)"
       if [ -z "$value" ]; then

# Get resolvconf configuration:
create_resolvconf() {
   foreign_options | grep "^dhcp-option DNS " | sed "s/^dhcp-option DNS /nameserver /"

route_up() {
   # Append nameservers to resolvconf (it would be better to override them):
   create_resolvconf | resolvconf -a $rdev

route_pre_down() {
   # Kill switch (adjust with your real network interface):
   sudo ip link set eth0 up
   # Restore the DNS config:
   resolvconf -d $rdev

case "$script_type" in
   route-up) route_up "$@" ;;
   pre_down) route_pre_down "$@" ;;

With this OpenVPN configuration snippet:

script-security 2
down my_script
route-pre-down my_script

In order to get this working, please make sure you firstly:

1) Sort out DNS nameservers

nano /etc/resolv.conf

and change it so you have


2) Download OpenVPN configurations from VPNBook and extract them somewhere.

3) In Iceweasel/Firefox type in the URL bar:


it will ask you to 'be careful'

4) Search for 'media.peerconnection.enabled' and make sure it is set to false by double clicking it.

5) Close your browser

6) Change directory in terminal to where you have extracted OpenVPN config files.

7) Use the openvpn command to load the VPN and enter in the username and password.

8) Once it has initialized go to your browser and check dnsleaktest


You should try to configure your proxychains

Edit /etc/proxychains.conf: change it to dynamic, and add socks5 9050 after socks4.

use in a terminal:
~$ proxychains iceweasel www.dnsleaktest.com


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.