openvpn via command line: permission denied to update resolv.conf

Question

This might be a duplicate of this question, but I am not proficient enough in networking matters to tell for sure.

I use a VPN service named Cyberghost to stay private on the internet. After facing DNS leaks when using network-manager I tried using the command line and implement fixes promoted online. Aparantly block-outside-dns works on windows only. Therefore I followed this tutorial and added the lines

script-security 2
up /etc/resolv.conf
down /etc/resolv.conf

to the .ovpn file provided by cyberghost.

When trying to connect using

sudo openvpn --config /home/username/CG/DE/DE.ovpn

however I get the following error:

Options error: --up script fails with '/etc/resolv.conf': Permission denied
Options error: Please correct this error.
Use --help for more information.

Connecting without the up and down command works fine but causes dns leaks. I do not encounter problems manually editing resolv.conf using sudo privilleges therefore I am unsure why openvpn should lack the permission to do so.

Thank you for your thoughts and your help,

Alex

---

System: Kubuntu 17.04

openvpn 2.4.0-4ubuntu1.3

The full .ovpn-file is as follows:

client

remote 1-de.cg-dialup.net 443

dev tun 

proto udp

auth-user-pass /home/username/CG/DE/auth.txt




resolv-retry infinite 

redirect-gateway def1

persist-key

persist-tun

nobind

cipher AES-256-CBC

auth MD5

ping 5

ping-exit 60

ping-timer-rem

explicit-exit-notify 2

script-security 2

remote-cert-tls server

route-delay 5

tun-mtu 1500 

fragment 1300

mssfix 1300

verb 4

comp-lzo


ca /home/username/CG/DE/ca.crt

cert /home/username/CG/DE/client.crt

key /home/username/CG/DE/client.key

script-security 2
up /etc/resolv.conf
down /etc/resolv.conf

Answer 1

Regardless of whether or not this is what you really want or need to do, this bit here:

up /etc/resolv.conf
down /etc/resolv.conf

is not how this functionality works. Rather, the openvpn-systemd-resolved package dynamically updates the file /etc/resolv.conf, by specifying an executable script after the up and down in your openvpn client conf (as per the linked (and incomplete!) "tutorial"). But also, note there are different versions of this functionality; later versions use dbus, which I'm referencing; the previous version just used scripts & temp files. So that's why there's some inconsistency across articles/docs/tutorials.

So, assuming this package is installed (either via apt-get or apt):

sudo apt-get install openvpn-systemd-resolved

and verifying the service is running (if not: enable it and start it manually):

sudo service systemd-resolved status

then, there should be a script installed as /etc/openvpn/update-resolv-conf (or possibly in /etc/openvpn/scripts/ in other distributions) that modifies the /etc/resolv.conf for you.

So your openvpn client conf (which on non-windows clients should by convention have a ".conf" suffix, and they'll automatically be read if in /etc/openvpn; but on windows they typically use .ovpn for proper file association w/ openvpn) -- the openvpn client conf would contain, for example,

script-security 2
setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
down-pre

Then you'll noticed that it's the /etc/openvpn/update-systemd-resolved script that needs to be executable (it is by default), and /etc/resolv.conf will be a simple text file that is then updated with correct domain, nameserver, search entries (it's not an executable script).

The last element to tie tis together is to modify /etc/nsswitch.conf to contain something like the following (replacing the existing hosts: entry):

# Use systemd-resolved first, then fall back to /etc/resolv.conf
hosts: files resolve dns myhostname

See the linked update-systemd-resolved github page for details and options.

Answer 2

The only solution I can think of is running

sudo -s

Then running

openvpn --config file.ovpn

If that doesn't work try running

sudo chown root /etc/resolv.conf

or

sudo chown $USER /etc/resolv.conf

and as a last resort

sudo chmod 777 /etc/resolv.conf

Only use chmod 777 if nothing else works, as it can cause a security hole.