Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In fixing my admittedly somewhat custom setup on my Ubuntu 12.04 workstation, when I connect the VPN connection, the DNS server of it is added to the bottom of /etc/resolv.conf instead of the top, resulting in all DNS queries intended towards the VPN destination to fail (because the first DNS server on this list responds negatively to the queries and my computer never asks the bottom DNS server to provide it's answer).

If I edit /etc/resolv.conf by hand and simply move the nameserver record that Network Manager adds there to the top, it works fine. But this workaround is obviously not preferred.

I should probably mention I turned off dnsmasq because with it, the VPN's DNS resolution does not work at all, despite all the files containing what they should have.

What is the proper way to fix this?

share|improve this question

What should happen is that the VPN client proces should register the VPN nameserver address with resolvconf under the record name IFACE.CLIENT where IFACE is the name of the VPN network interface (e.g., tun0) and CLIENT is the name of the VPN client program; and the file /etc/resolvconf/interface-order should include a glob pattern matching this record name at an appropriately high priority: after loopback interfaces lo* but before the LAN interfaces such as eth*. In the factory-shipped interface-order file the tun* and tap* patterns are at the right position in the order.

If you are using a third party VPN client program then it may not support this, in which case you will have either to hack the latter program's scripts or adopt some workaround such as putting an address on a dns-nameservers line in /etc/network/interfaces (if ifup is used) or writing a custom resolvconf update script.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.