When I connect to a VPN network through Gnome Network-manager I lose DNS resolution and in practice, I cannot access resources inside the VPN network or outside.

When I was using Ubuntu 16.04 and I was using the VPN, the "/etc/resolv.conf/" file would contain the DNS servers of the (VPN) network I had connected. Now it always contains the following entries:

search myprovider.com

From what I have understood is the address of the DNS stub used by the system-resolved.

I suspect that this is a bug because the VPN was working fine the Ubuntu 16.04. Is there any way that I can set the DNS servers of my network when I am using a VPN service?


I tried connecting to the OpenVPN network with the configuration file attached at the end of the post, but I get the following error:

 Authenticate/Decrypt packet error: cipher final failed

I have verified that the server uses lzo compression and I have enabled it as well. The connection stays active but I cannot navigate to any page inside or outside the VPN.

In the configuration file listed below, I have included the solutions posted in the replies

 dev tun
 proto udp
 remote openvpn.bibsys.no 1194
 remote my-server-2 1194
 resolv-retry infinite
 user myuser
 group myuser
 ca ca-cert.pem
 cert openvpn.crt
 key openvpn.key
 cipher AES-256-CBC
 comp-lzo yes
 script-security 2
 up /etc/openvpn/scripts/update-systemd-resolved
 down /etc/openvpn/scripts/update-systemd-resolved
  • 2
    When debugging a similar problem to this that couldn't be solved exactly the same, I used resolvectl status and resolvectl help to figure out my specific solution. Apr 9, 2019 at 0:52

7 Answers 7



The file /etc/resolv.conf does not get updated by the /etc/openvpn/update-resolv-conf script because resolvconf is not installed by default on ubuntu 18.04.

In fact, one of the first lines of that script checks for the /sbin/resolvconf executable:

[ -x /sbin/resolvconf ] || exit 0

Installing resolvconf via apt-get is not a solution as the /etc/openvpn/update-resolv-conf script updates the /etc/resolv.conf file with the pushed DNS entry but the tun device seems to ignore it.


  1. Ubuntu 18.04 uses systemd-resolved, so all you have to do is install the openvpn helper script for systemd-resolved via

    sudo apt install openvpn-systemd-resolved

    or with these GitHub instructions

  2. Update your config.ovpn file adding these lines:

    script-security 2
    up /etc/openvpn/update-systemd-resolved
    down /etc/openvpn/update-systemd-resolved

    That instead of adding up and down of /etc/openvpn/update-resolv-conf to the conf.

  3. To prevent DNS Leakage, you should add this line to the end of the config.ovpn file (according to this systemd issue comment):

    dhcp-option DOMAIN-ROUTE .
  • 1
    Thanks a lot, working for me on Ubuntu 18.04. And I want to specify, that parameter script-security 2 is still needed before up/down lines, otherwise the program falls down with an error (OpenVPN 2.4.4)
    – lucidyan
    Jun 8, 2018 at 20:51
  • 1
    @Qlimax Do you know how do we import these settings to the gnome openvpn client?
    – orestis
    Jun 16, 2018 at 21:05
  • 2
    @orestis you have to install this package sudo apt-get install network-manager-openvpn-gnome Then you should be able to import .ovpn config files into the gnome network manager. askubuntu.com/questions/187511/… UI has changed over time, you should be able to find that in settings->network->vpn
    – Qlimax
    Jun 18, 2018 at 9:06
  • 3
    This should be the accepted answer. Dec 18, 2018 at 0:25
  • 4
    Surprised this works for so many of you: I have an ovpn.config, yes, but NetworkManager does not seem to use it. Did you edit the file and the re-import it, in particular to replace the up/downs scripts. Because I see this opaque binary /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper used for which i could not find documentation. If re-import of ovpn.config is needed, please amend the answer.
    – Harald
    May 31, 2019 at 6:43

I found a solution on this blog post. While there are two solutions mentioned, I prefer using the second one because it means my DNS is set by the OpenVPN server (the first solution means I use the same DNS servers whether or not I'm connected to the OpenVPN server).

In short:

  • sudo mkdir -p /etc/openvpn/scripts
  • sudo wget https://raw.githubusercontent.com/jonathanio/update-systemd-resolved/master/update-systemd-resolved -P /etc/openvpn/scripts/
  • sudo chmod +x /etc/openvpn/scripts/update-systemd-resolved

Then edit your OpenVPN client file (e.g. client.ovpn) by changing the up/down scripts to:

script-security 2
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
up /etc/openvpn/scripts/update-systemd-resolved
down /etc/openvpn/scripts/update-systemd-resolved

(I have commented out the original up/down settings).

  • If one is using the gnome openvpn utility where should the file config.ovpn be stored?
    – orestis
    May 17, 2018 at 12:19
  • 2
    config.ovpn isn't "found" - it's the client config file used for connecting. You either generate it, or it is issued to you by your OpenVPN provider (and it might not be called config.ovpn - it could be called anything, like client.ovpn). May 26, 2018 at 19:30
  • This works just perfectly. Jan 16, 2019 at 9:36
  • 2
    I get WARNING: Failed running command (--up/--down): external program fork failed
    – blockhead
    May 7, 2019 at 13:38
  • Unfortunately this didn’t work for a vpn which is using tcp, sites outside vpn are not resolved, hence I started using client.pritunl.com/#install found useful Oct 2, 2019 at 16:31

Actually, there is a much easier solution to this problem. The issue is with DNS traffic and how Ubuntu 18 manages that. By default IP forwarding is disabled which is what OpenVPN needs in order to provide proper networking. All you have to do is run the following command:

sudo nano /etc/sysctl.conf

Once you have this file opened, look for the line that contains net.ipv4.ip_forward. If this line is commented, remove the # sign at the front of the line (if it is not commented then you have another issue). Save the file and then restart your OpenVPN server instance.

This fix does not require any modifications to the client or OpenVPN code following upgrade to Ubuntu 18. Tested and confirmed working.

However, this obviously requires you can administer the server. And unfortunately, the bug exists for many who just connect with 18.04 to an OpenVPN server that is administered by somebody else...

  • 1
    didn't work for me. how did you determine that this was the problem, in your case?
    – hwjp
    Nov 27, 2018 at 12:13
  • 6
    WARNING: you do not need to enable ip_forward on the openvpn client, NEVER! it is a security risk. On the openvpn server, you may need it, depending on the config used and this is probably why this comment show up.
    – higuita
    May 22, 2019 at 16:48
  • This was it for me. Weird issue. Thanks.
    – Kevin C
    Nov 20, 2019 at 16:40
  • this seems to work for me ! Thanks. I tested so many different fixes... Dec 18, 2019 at 9:41

Tested on Ubuntu 18.04 at 13 Sep 2018

There is another useful command to setup what you need via command line. You can control your VPN connection both with command line and GUI.

sudo nmcli connection add type vpn vpn-type openvpn con-name la.vpn.contoso.com ifname --

ifname -- is the required by default, but does not affect anything

sudo nmcli connection modify la.vpn.contoso.com ipv4.dns
sudo nmcli connection modify la.vpn.contoso.com ipv4.dns-search int.contoso.com
sudo nmcli connection modify la.vpn.contoso.com ipv4.never-default yes

never-default should not use remote gateway as default route

And much more interested final touch:

nmcli connection modify la.vpn.contoso.com vpn.data 'ca = /tmp/la.vpn.contoso.com/you/ca.crt, key = /tmp/you.key, dev = tun, cert = /tmp/you.crt, cert-pass-flags = 1, comp-lzo = adaptive, remote = la.vpn.contoso.com:1194, connection-type = tls'

Afterwards you can control vpn with GUI or use following commands:

sudo nmcli --ask connection up la.vpn.contoso.com
sudo nmcli connection down la.vpn.contoso.com

If your system is using NetworkManager, then you may only need to change the connection's DNS priority, as per this answer:

nmcli -p connection modify VPN_CONNECTION_NAME ipv4.dns-priority -1

In my case, the DNS was being updated, but ignored as the existing DNS servers had precedence. You may need root/sudo. If that doesn't work, try ipv6.dns-priority.


I'm impacted too. In my case, I'm using OpenVPN with an internal name server (which is inside the VPN). That worked until Ubuntu 17.10 (with hosts: files dns in /etc/nsswitch.conf).

/etc/resolv.conf was updated correctly by the openvpn scripts (through calls to /etc/openvpn/update-resolv-conf in the openvpn client configuration file).

However, name resolution for hosts inside the VPN was not working any more (or at least sporadically... I guess the local DNS cache was picking the names, but after a rather long time).

What seems to help, or even resolve the issue (though that's too early to say) is to install the below package:

sudo apt install openvpn-systemd-resolved
  • Eventually, it doesn't seem to be a solution. I have the problem again. I guess something else made it work... May 13, 2018 at 16:48
  • 2
    Maybe then you delete your answer? It seems that the decision has already been found below
    – lucidyan
    Jul 25, 2018 at 20:58

None of the proposed CLI-oriented (non-NetworkManager) solutions worked for me (I don't even have up and down lines in myconfig.ovpn).

However, I've found that NetworkManager VPN seems to work again (it did not work a year or two ago, which is why I switched to openvpn CLI then). I did not tweak it in any way: just tried to activate it with the appropriate credentials.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .