5

I am trying to activate NordVPN CyberSec by completing the following instructions in Debian 9. I should be able to do the changes as root and with sudo like described for Ubuntu in the thread Should I edit my resolv.conf file to fix wrong DNS problem? and in the thread Linux: How do i edit resolv.conf but I cannot.

If you are using Linux or Mac OS X, please open the terminal and type in: su You will be asked for your root password, please type it in and press enter rm -r /etc/resolv.conf nano /etc/resolv.conf When the text editor opens, please type in these lines: 

nameserver 103.86.99.99
nameserver 103.86.96.96

Now you have to close and save the file, you can do that by clicking Ctrl + X and pressing Y. Then please continue typing in the terminal: 

chattr +i /etc/resolv.conf 
reboot now

That is it. Your computer will reboot and everything should work correctly. If you will ever need to change your DNS addresses, please open the terminal and type in the following: su You will be asked for your root password, please type it in and press enter 

 chattr -i /etc/resolv.conf 
 nano /etc/resolv.conf

Change DNS addresses, save and close the file. 

 chattr +i /etc/resolv.conf

I do the first step as su/root but get the following. Trying to change the file /etc/resolv.conf content there with sudo, I get operation not permitted. 

root@masi:/etc# ls -la * | grep resolv.conf
-rw-r--r--  1 root root       89 Jan 22  2017 resolv.conf
-rw-r--r--  1 root root       89 Jul 25 17:10 resolv.conf~
-rw-r--r--  1 root root        0 Jan 22  2017 resolv.conf.tmp
-rwxr-xr-x   1 root root  1301 Nov 12  2015 update-resolv-conf

root@masi:/etc# sudo mv resolv.conf resolv.conf.tmp2
mv: cannot move 'resolv.conf' to 'resolv.conf.tmp2': Operation not permitted

OS: Debian 9

Improve this question
6

As per your steps, you protected the file /etc/resolv.conf from being deleted/overwritten with chattr +i (immutable)

So, you won't be able to move it to another file without doing sudo chattr -i /etc/resolv.conf first.

From man chattr

A file with the 'i' attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

Improve this answer
4
  • My internet stop working with the given nameservers. I need to add 8.8.4.4 there in the file. Do you understand why? – Léo Léopold Hertz 준영 Jul 25 '17 at 17:43
  • 1
    @LéoLéopoldHertz준영 They are their DNS servers, and they only work once their VPN is up; i.e. for their customers. While the answer is technically correct, the chattr +i only must be done (in a script), once the VPN is up. – Rui F Ribeiro Jul 25 '17 at 17:46
  • Please, see my wiki answer for the explanation why you need the first line in the file. Can you agree? – Léo Léopold Hertz 준영 Jul 25 '17 at 17:47
  • @LéoLéopoldHertz준영 The question is devolving into VPN matters, I do advise to open other related questions. – Rui F Ribeiro Jul 25 '17 at 17:50
0

NordVPN's proposal about two nameservers did not work: internet does not work when VPN is not on - did not test it when it is on because I want that internet works when VPN is off too - maybe, this is the reason why you need 8.8.4.4 nameserver. You need instead

nameserver 8.8.4.4
nameserver 103.86.99.99
nameserver 103.86.96.96

I contacted the support to ask for the explanation about this. I requested also for a tool to test that CyberSec feature works in my VPN connection.

Improve this answer
2
  • 1
    This means you are using Google DNS in and out of VPN, and thus having DNS leaking outside of the VPN. Their DNS servers must be used while inside the VPN, and Google outside - in fact you may be using DNS in turns, more complicated, but you got the idea. Actually I have setup VPNs for use in our organization, and I intercept DNS requests, and it does not matter whichever DNS the client has configured. I am surprised both they do not do that, and also they do not provide clearer instructions. – Rui F Ribeiro Jul 25 '17 at 17:49
  • @RuiFRibeiro I extended the thread here about the issue unix.stackexchange.com/q/381771/16920 – Léo Léopold Hertz 준영 Jul 25 '17 at 18:48
0
Sudo chattr -a /etc/resolv.conf

Sudo lsattr /etc/resolv.conf

Remove file and make new file with only google dns ip. It will work!

Improve this answer
1
  • Also -i flag can achieve that file. – Hamed Rostami Aug 28 '19 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.