I setup an openvpn server with static key (certificate mode is not usable due to DPI at the national gateway), but I cannot successfully change the DNS automatically after the connection. I searched over the Internet and SE, and every one suggests the use dhcp-option.

I tried to add this line to client.ovpn

dhcp-option DNS

There is no effect. I tried to add this line in server conf

push "dhcp-option DNS"

Neither has any effect.

In fact, according to the manual,

--dhcp-option type [parm]

Set extended TAP-Win32 TCP/IP properties, must be used with --ip-win32 dynamic or --ip-win32 adaptive.

But my client is a Mac machine, server Linux. Any solutions to the problem?

  • 1
    You should mention what client you're using on the OSX machine.
    – FloHimself
    Commented May 7, 2015 at 8:06
  • 2
    @FloHimself: The standard command line utility openvpn.
    – Siyuan Ren
    Commented May 7, 2015 at 9:11

4 Answers 4


On a Linux system, you need to run an external script.

Here is the documentation: https://wiki.archlinux.org/index.php/OpenVPN#DNS

Scripts are found on here or newer Linux version here and you can call them by adding this on the openvpn client configuration:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

I'm no expert, but from reading the man page below your quote:

--dhcp-option type [parm]


Note that if --dhcp-option is pushed via --push to a non-windows client, the option will be saved in the client's environment before the up script is called, under the name "foreign_option_{n}".

and under foreign_option_{n}:


An option pushed via --push to a client which does not natively support it, such as --dhcp-option on a non-Windows system, will be recorded to this environmental variable sequence prior to --up script execution.

So the command line openvpn client doesn't automatically modify the DNS setup on your OSX machine after establishing the connection. But since the DNS options are saved to the client's environment, you can specify a script to append the pushed servers to the system's current DNS config with the --up option:

--up cmd

Run command cmd after successful TUN/TAP device open (pre --user UID change).

cmd consists of a path to script (or executable program), optionally followed by arguments. The path and arguments may be single- or double-quoted and/or escaped using a backslash, and should be separated by one or more spaces.

E.g. Tunnelblick also does this by utilizing this script.

Another solution might be a script that was posted to the openvpn mailing list at DNS for OS X clients - the Definitive Guide.

  • What about iPhone? Without jailbreaking, I imagine there is no bash or any command to change the DNS automatically.
    – Siyuan Ren
    Commented May 7, 2015 at 10:46
  • @SiyuanRen Without jailbraking you probably don't use the command line openvpn client on an iPhone...
    – FloHimself
    Commented May 7, 2015 at 10:56
  • The official openvpn app simply loads a text configuration file and runs it. There is no more functionality.
    – Siyuan Ren
    Commented May 7, 2015 at 11:07
  • @SiyuanRen Well, the official openvpn app is not the command line application that is discussed here.
    – FloHimself
    Commented May 7, 2015 at 11:15
  • This feels like an hack. When I connect with PPTP or L2TP, there is a dedicated interface available in the Network preferences, with their only IP and DNS. OpenVPN requires me to change the DNS settings of other interfaces?
    – Siyuan Ren
    Commented May 7, 2015 at 23:48

I had the same problem with both Linux OS (server and client), and I solved itm installing dnsmasq on server that was missing

so my steps:

apt-get install dnsmasq

in server.conf

push "redirect-gateway def1" push "dhcp-option DNS" push "dhcp-option DNS"

And I could connect and browse domains through the server IP , connecting with NetWorkManager with DNS sets to automatic


Add this command to your client side conf file..

# put actual dns name here
dhcp-option DNS 

It will definitely work..

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .