How to define DNS server in openvpn?

Question

I setup an openvpn server with static key (certificate mode is not usable due to DPI at the national gateway), but I cannot successfully change the DNS automatically after the connection. I searched over the Internet and SE, and every one suggests the use dhcp-option.

I tried to add this line to client.ovpn

dhcp-option DNS 8.8.8.8

There is no effect. I tried to add this line in server conf

push "dhcp-option DNS 8.8.8.8"

Neither has any effect.

In fact, according to the manual,

--dhcp-option type [parm]

Set extended TAP-Win32 TCP/IP properties, must be used with --ip-win32 dynamic or --ip-win32 adaptive.

But my client is a Mac machine, server Linux. Any solutions to the problem?

You should mention what client you're using on the OSX machine. — FloHimself, May 07 '15 at 08:06

score 10 · Answer 1 · edited Mar 11 '18 at 15:53

10

On a Linux system, you need to run an external script.

Here is the documentation: https://wiki.archlinux.org/index.php/OpenVPN#DNS

Scripts are found on here or newer Linux version here and you can call them by adding this on the openvpn client configuration:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

edited Mar 11 '18 at 15:53

Jeff Schaller

66,199
35
114
250

answered Sep 01 '17 at 02:57

Damien

201
2
4

1

If your Linux flavor uses NetworkManager, see [the alterations to work with `nmcli`](https://serverfault.com/a/944262/50236). – palswim Dec 14 '18 at 18:38
This doesn't seem to work in Ubuntu 16.04. Is it only functional for some operating systems? – openCivilisation Aug 16 '20 at 03:49

score 6 · Answer 2 · edited Mar 04 '19 at 11:32

6

I'm no expert, but from reading the man page below your quote:

--dhcp-option type [parm]

...

Note that if --dhcp-option is pushed via --push to a non-windows client, the option will be saved in the client's environment before the up script is called, under the name "foreign_option_{n}".

and under foreign_option_{n}:

foreign_option_{n}

An option pushed via --push to a client which does not natively support it, such as --dhcp-option on a non-Windows system, will be recorded to this environmental variable sequence prior to --up script execution.

So the command line openvpn client doesn't automatically modify the DNS setup on your OSX machine after establishing the connection. But since the DNS options are saved to the client's environment, you can specify a script to append the pushed servers to the system's current DNS config with the --up option:

--up cmd

Run command cmd after successful TUN/TAP device open (pre --user UID change).

cmd consists of a path to script (or executable program), optionally followed by arguments. The path and arguments may be single- or double-quoted and/or escaped using a backslash, and should be separated by one or more spaces.

E.g. Tunnelblick also does this by utilizing this script.

Another solution might be a script that was posted to the openvpn mailing list at DNS for OS X clients - the Definitive Guide.

edited Mar 04 '19 at 11:32

mivk

3,446
29
31

answered May 07 '15 at 09:30

FloHimself

11,272
3
22
24

What about iPhone? Without jailbreaking, I imagine there is no bash or any command to change the DNS automatically. – Siyuan Ren May 07 '15 at 10:46
@SiyuanRen Without jailbraking you probably don't use the command line openvpn client on an iPhone... – FloHimself May 07 '15 at 10:56
The official openvpn app simply loads a text configuration file and runs it. There is no more functionality. – Siyuan Ren May 07 '15 at 11:07
@SiyuanRen Well, the official openvpn app is not the command line application that is discussed here. – FloHimself May 07 '15 at 11:15
This feels like an hack. When I connect with PPTP or L2TP, there is a dedicated interface available in the Network preferences, with their only IP and DNS. OpenVPN requires me to change the DNS settings of *other* interfaces? – Siyuan Ren May 07 '15 at 23:48
I'm no expert and mostly just quoting from man page. You may want to start a bounty to get this question more attention. – FloHimself May 08 '15 at 05:07

score 4 · Answer 3 · answered May 23 '16 at 16:42

I had the same problem with both Linux OS (server and client), and I solved itm installing dnsmasq on server that was missing

so my steps:

apt-get install dnsmasq

in server.conf

push "redirect-gateway def1" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4"

And I could connect and browse domains through the server IP , connecting with NetWorkManager with DNS sets to automatic

score -2 · Answer 4 · edited Mar 29 '16 at 21:29

-2

Add this command to your client side conf file..

# put actual dns name here
dhcp-option DNS 10.11.12.13

It will definitely work..

edited Mar 29 '16 at 21:29

roaima

107,089
14
139
261

answered Mar 27 '16 at 20:56

Vinood NK Maheshwari

394
1
11

How to define DNS server in openvpn?

4 Answers4