Ubuntu 15.10 and dns=dnsmasq is commented out in /etc/NetworkManager/NetworkManager.conf

Before I connect to a VPN /etc/resolv.conf contains

nameserver 2xx.xx.xx.xx <-- ISP DNS 1
nameserver 2xx.xx.xx.xx <-- ISP DNS 2

after a VPN connection /etc/resolv.conf contains

nameserver 1xx.xx.xx.xx <-- VPN DNS 1
nameserver 1xx.xx.xx.xx <-- VPN DNS 2
nameserver 2xx.xx.xx.xx <-- ISP DNS 1

The regular wired connection and the VPN have DNS servers set in network manager with automatic (only addresses). The ISP server shouldn't be there at all. What else can I change? (removing dns=dnsmasq was one change to stop split DNS).

1 Answer 1


NetworkManager can either:

  • update resolv.conf itself;

  • delegate to resolvconf (for the NetworkManager interface);

  • or use netconfig.

The different configurations coming from each interface are simply aggregated (see update_dns()).

If you do not use NetworkManager for the VPN, you might use openresolv exclusive mode (-x) in order to override the nameservers from NetworkManager with the ones from the VPN instead of adding them. This can be done with this (ugly) script (OpenVPN hook):


# Dump all foreign options (coming from environment variables foreign_option_N) to stdout
foreign_options() {
    local i
    while true; do
      local varname=foreign_option_$i
      local value="$(eval echo \$$varname)"
      if [ -z "$value" ]; then
      echo $value

#Create a resolv.conf file from OpenVPN environment variables
create_resolvconf() {
    foreign_options | grep "^dhcp-option DNS " | sed "s/^dhcp-option DNS /nameserver /"

route_up() {    
    create_resolvconf | resolvconf -x -a $dev

down() {
    resolvconf -d $dev

case "$script_type" in
    route-up) route_up "$@" ;;
    down) down "$@" ;;

You should be able to adapt this to be used as a NetworkManager dispatcher script (see man 8 NetworkManager) using:


I didn't test it but something like this should do the trick:


create_resolvconf() {
         echo "nameserver $ip"

up() {
   create_resolvconf | resolvconf -x -a $VPN_IP_IFAC

down() {
   resolvconf -d $VPN_IP_IFAC

if [ -z "$VPN_IP_IFACE" ]; then
  return 0

case "$2" in
   up) up ;;
   down) down ;;
  • Thanks for the detailed reply. The dispatcher script causes an error in syslog: "resolvconf: Error: Command not recognized", "Usage: resolvconf (-d IFACE|-a IFACE|-u|--enable-updates|--disable-updates|--updates-are-enabled)". I think it might not be recognizing the -x, as that option does not appear in man resolvconf.
    – user157600
    Feb 22, 2016 at 1:02
  • @user157600, The -x options needs openresolv instead of resolvconf.
    – ysdx
    Feb 22, 2016 at 1:26
  • Fixed openresolv. Now I have 2 VPN and 2 ISP DNS servers in resolv.conf. Previously is was 2 VPN and 1 DNS. I do appreciate the attempt to help, but this is way out of my level of understanding of these things. I hope there can be a simpler solution somewhere.
    – user157600
    Feb 22, 2016 at 2:31
  • 1
    Given that you are in control of effective dns usage, when vpn is up you may DNAT dns ports to desired nameserver in order to override local configuration Feb 17, 2020 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.