I am running ubuntu xenial 16.04

We are using openvpn to connect to a virtual private cloud. That cloud has it's own DNS server (as does our local route - home or office).

When I connect to the VPN all of the IPs in that network are available but I can't reach any by host name. The reason is simple: the resolv.conf file still shows my local office nameserver. If I manually overwrite the resolv.conf to have the correct name server all is good.

So, how can I get it to automatically reconfigure resolv.conf upon connecting to the VPN?

Can I hook in to a system event and execute a script?

  • 1
    Normally there's an option to allow the VPN to push its own DNS server. Which client are you using— tunnelblick?
    – Ryder
    May 26 '16 at 21:59
  • I am using the official openvpn client. Somewhere I read that the VPN process can't update DNS. May 29 '16 at 17:15
  • Have you tried the --register-dns option? Alternatively there are client-side options you can set, as dhcp-options (the flip side of the instructions here openvpn.net/index.php/open-source/documentation/howto.html#dhcp)
    – Ryder
    May 29 '16 at 18:14

The OpenVPN package has a script for this in /etc/openvpn/update-resolv-conf. You need to configure it with:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

This will fetch the DNS server addresses from the dhcp-option DNS options passed by the OpenVPN peer/server and configure resolvconf accordingly. It handles dhcp-option DOMAIN as well.

It is not perfect however, because this will prepend those name servers to the list of existing name servers instead of overwriting the list of name servers. If you are using openresolv the -x can be used to overwrite the DNS configuration instead of preprending to it.

If you're using systemd-resolved, you can use the /etc/openvpn/update-systemd-resolved which hooks into systemd-revolved instead of resolvconf.

script-security 2 
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved

On Debian, this script is in the openvpn-systemd-resolved.

  • 2
    above these 2 lines, you will also need to add script-security 2 or run your openvpn with --script-security 2
    – 32r34wgf3e
    Jul 24 '18 at 17:53

Here is the solution I came up with: There is a switch that allows you to run a script when the tunnel is up and running. I use the switch to essentially overwrite the resolv.conf file with one I know is correct. It's a total hack, I know.

sudo openvpn --up reset-dns.sh --client client.ovpn

the script (reset-dns):

cp ~/resolv.conf /etc/resolv.conf

Also, for those say "OMG! You're running that tunnel as root!" It won't run any other way; even before my DNS hack.

I am definitely open to a better way. The network manager for ubuntu simply won't work. I have cut tickets to ubuntu on this repeatedly

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.