I manage my WLAN interface through systemd-networkd and use systemd-resolved for the whole system.
I have several VPN connections managed by OpenVPN or Openconnect. I have them properly configured to set the DNS information via the systemd-resolved API (done e.g. by
/etc/openvpn/update-systemd-resolved) and it works.
Unfortunately, by default the VPN links have
DNSDefaultRoute=yes as reported by
resolvectl. This means that when the VPN connection is interrupted, DNS resolution on the system can hang sometimes.
I'd like to set
DNSDefaultRoute=no for these VPN interfaces, but keep them unmanaged by systemd-networkd, i.e. let the VPN tools configure the interfaces.
More generally, my question is whether it is possible to have a per-link systemd-resolved configuration without having the links managed by systemd-networkd.
What I tried thus far
I attempted to create a file
/etc/systemd/network/30-tun-no-default-route.network with the contents
[Match] Name=tun_* [Link] Unmanaged=true [Network] DNSDefaultRoute=false
I tested that with
Unmanaged=false the links get the proper
DNSDefaultRoute=false setting, but of course by then systemd-networkd breaks the VPN connection. Unfortunately, with
Unmanaged=true, resolved seems to ignore this setting.
To me this seems like systemd-resolved does not interpret
*.network files itself. However, this makes it hard to set such resolved-related settings per-link. Perhaps I should submit a feature request for this?
Another possible workaround is to have the VPN post-scripts run
resolvectl default-route $IFACE, but that to me seems unsystematic and to go against the purpose of having a declarative-style configuration as done with most systemd stuff.