0

OpenVPN client and systemed-resolved.

When I run OpenVPN client, it'll get connected and will be able to load the target resources properly only during the very first launch, after reboot. On all the consequentive launches, it'll get connected still "Initialization Sequence Completed", but the resources won't get loaded.

By trial and error I've found out that it's an issue that has to do with DNS.

sudo resolvectl status
===>

# 1st launch

Link 6 (tun0)
    Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6
         Protocols: +DefaultRoute +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported
       Current DNS Server: 10.1.1.7
       DNS Servers: 10.1.1.7
       DNS Domain: aaa.xyz


# all other ones

Link 6 (tun0)
       Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6
         Protocols: +DefaultRoute +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported
        DNS Domain: aaa.xyz

 

I've found a cure:

sudo systemd-resolve -i tun0 \
  --set-dns=10.1.1.7 \
  --set-domain=aaa.xyz \
  --set-dnssec=off
 

which will have to be run each time OpenVPN gets restarted.

How to make it run automatically?

Or rather - why does this happen at all? How to make OpenVPN set the proper DNS automatically?

And why does it get set properly right after reboot of the computer and only during the 1st time?

4
  • Could you run OpenVPN with --verb 4 (command line) or verb 4 (client configuration file) added so we can see the parameters and connection logs? Make sure to sanitize stuff like host IP and client IP addresses, user names, etc. from the logs.
    – ErikF
    Apr 12 at 2:29
  • @ErikF who "we"?
    – barugaggi
    Apr 12 at 2:53
  • The people who are trying to determine what's possibly causing your issue.
    – ErikF
    Apr 12 at 4:23
  • @ErikF why do you talk on behalf of other people?
    – barugaggi
    Apr 12 at 12:59

1 Answer 1

0

You can add a hook to have OpenVPN configure the DNS though systemd-resolved.

From https://github.com/jonathanio/update-systemd-resolved, grab the update-systemd-resolved script and mark it as executable.

$ sudo wget -O /usr/local/bin/update-systemd-resolved \
  https://raw.githubusercontent.com/jonathanio/update-systemd-resolved/master/update-systemd-resolved \
  && sudo chmod +x /usr/local/bin/update-systemd-resolved

Then add the following to your OpenVPN client config

# /etc/openvpn/client/<your config file>.conf
...
script-security 2
setenv PATH /usr/bin
up /usr/local/bin/update-systemd-resolved
down /usr/local/bin/update-systemd-resolved
down-pre

If your OpenVPN is running as a non-root user (true by default), you'll need to add a PolicyKit rule that allows OpenVPN to interact with DBus.

# /etc/polkit-1/rules.d/00-openvpn-resolved.rules
polkit.addRule(function(action, subject) {
    if (action.id == 'org.freedesktop.resolve1.set-dns-servers' ||
        action.id == 'org.freedesktop.resolve1.set-domains' ||
        action.id == 'org.freedesktop.resolve1.set-dnssec') {
        if (subject.user == 'openvpn') {
            return polkit.Result.YES;
        }
    }
});

As for why your OpenVPN instance configures the DNS on the first run and why it fails to do so in subsequent runs, there could be a bunch of different reasons. It would require some more investigation to get to the bottom of it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .