14

I am running ubuntu xenial 16.04

We are using openvpn to connect to a virtual private cloud. That cloud has it's own DNS server (as does our local route - home or office).

When I connect to the VPN all of the IPs in that network are available but I can't reach any by host name. The reason is simple: the resolv.conf file still shows my local office nameserver. If I manually overwrite the resolv.conf to have the correct name server all is good.

So, how can I get it to automatically reconfigure resolv.conf upon connecting to the VPN?

Can I hook in to a system event and execute a script?

Christian Bongiorno
  • 307
  • 1
  • 3
  • 11
  • 1
    Normally there's an option to allow the VPN to push its own DNS server. Which client are you using— tunnelblick? – Ryder May 26 '16 at 21:59
  • I am using the official openvpn client. Somewhere I read that the VPN process can't update DNS. – Christian Bongiorno May 29 '16 at 17:15
  • Have you tried the `--register-dns` option? Alternatively there are client-side options you can set, as dhcp-options (the flip side of the instructions here https://openvpn.net/index.php/open-source/documentation/howto.html#dhcp) – Ryder May 29 '16 at 18:14

2 Answers2

9

The OpenVPN package has a script for this in /etc/openvpn/update-resolv-conf. You need to configure it with:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

This will fetch the DNS server addresses from the dhcp-option DNS options passed by the OpenVPN peer/server and configure resolvconf accordingly. It handles dhcp-option DOMAIN as well.

It is not perfect however, because this will prepend those name servers to the list of existing name servers instead of overwriting the list of name servers. If you are using openresolv the -x can be used to overwrite the DNS configuration instead of preprending to it.

If you're using systemd-resolved, you can use the /etc/openvpn/update-systemd-resolved which hooks into systemd-revolved instead of resolvconf.

script-security 2 
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
down-pre

On Debian, this script is in the openvpn-systemd-resolved.

ysdx
  • 1,818
  • 15
  • 14
  • 2
    above these 2 lines, you will also need to add `script-security 2` or run your `openvpn` with `--script-security 2` – 32r34wgf3e Jul 24 '18 at 17:53
0

Here is the solution I came up with: There is a switch that allows you to run a script when the tunnel is up and running. I use the switch to essentially overwrite the resolv.conf file with one I know is correct. It's a total hack, I know. 

sudo openvpn --up reset-dns.sh --client client.ovpn

the script (reset-dns):

#!/bin/bash
cp ~/resolv.conf /etc/resolv.conf

Also, for those say "OMG! You're running that tunnel as root!" It won't run any other way; even before my DNS hack.

I am definitely open to a better way. The network manager for ubuntu simply won't work. I have cut tickets to ubuntu on this repeatedly

Christian Bongiorno
  • 307
  • 1
  • 3
  • 11