3

I'm using a OpenVPN connection between my laptop and my server. The configuration was working until today (i simply ran apt update && apt upgrade), but since then my DNS settings are "wrong" after connecting to the OpenVPN.

After connecting to the OpenVPN Server, i have two "catch all" DNS Domain entries (DNS Domain: ~.) in my systemd-resolve configuration.

Stripped output of systemd-resolve --status:

Link 11 (tun0)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 192.168.X.Y
          DNS Domain: ~.

Link 2 (enp0s25)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 10.16.X.Y
                      10.16.X.Y
          DNS Domain: ~.

Therefore DNS queries now aren't savely tunneled through the VPN but also may be transfered via the normal network.

This leads to a DNSLeak and even worse: VPN-Internal Hostnames aren't resolved correctly (every now and then).

I only know of options to add the DNS Domain: ~. entry to the tun0-Interface for resolved. But how do i remove an already existing one from the real interface?

I'm already using this config to update systemd-resolved in my OpenVPN client.conf:

# Upate systemd-resolvd
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
down-pre
dhcp-option DOMAIN-ROUTE .

Anybody got an idea how to solve this?

// Update: Looks like this is a longer known problem with NetworkManager starting to attach the root DNS Domain to links at random. There is an interesting discussion about it in a GitHub Issue in the repo of the developer of the update-systemd-resolved script.

// Probably this commit to NetworkManager broke it. Since it introduced the default dns route for all interfaces behavior.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.