0

After connecting from at home via VPN to my institute by

sudo openvpn --config /home/myname/thinkpad1/thinkpad1.ovpn

I cannot browse web pages. (The connection itself seems to be OK, saying "Initialzation sequence completed"). In analyzing the problem on the command line I see:

ping google.com

gives no answer, whereas

ping 8.8.8.8

is successful.

But calling

http://8.8.8.8

in the browser is NOT successful.

Further: Performing

route -n

I get:

(1) Without VPN connection

Kernel-IP-Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG    600    0        0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlan0
192.168.0.0     0.0.0.0         255.255.255.0   U     600    0        0 wlan0

(2) With VPN

Kernel-IP-Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.217      128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.0.1     0.0.0.0         UG    600    0        0 wlan0
10.8.0.1        10.8.0.217      255.255.255.255 UGH   0      0        0 tun0
10.8.0.217      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.8.0.217      128.0.0.0       UG    0      0        0 tun0
147.142.19.56   192.168.0.1     255.255.255.255 UGH   0      0        0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlan0
192.168.0.0     0.0.0.0         255.255.255.0   U     600    0        0 wlan0 

Edit: Both with VPN up and with VPN down, the command

ls -al /etc/resolv.conf

brings

lrwxrwxrwx 1 root root 29 Jan 13  2016 /etc/resolv.conf -> ../run/resolvconf/resolv.conf

and

cat /etc/resolv.conf

brings

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.1.1
search box

And

systemd-resolve --status

says "unknown option"

I tried

systemd-resolve --version

and get

systemd 229
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN

The command

ls -al /etc/openvpn

yields insgesamt 20

drwxr-xr-x   2 root root  4096 Aug 22 12:38 .
drwxr-xr-x 161 root root 12288 Aug 23 11:52 ..
-rwxr-xr-x   1 root root  1301 Jun 22  2017 update-resolv-conf

And

grep -i -A3 script-security /home/myname/thinkpad1/thinkpad1.ovpn

yields nothing.

Wheres

dpkg -l resolv*

gives

Gewünscht=Unbekannt/Installieren/R=Entfernen/P=Vollständig Löschen/Halten
| Status=Nicht/Installiert/Config/U=Entpackt/halb konFiguriert/
         Halb installiert/Trigger erWartet/Trigger anhängig
|/ Fehler?=(kein)/R=Neuinstallation notwendig (Status, Fehler: GROSS=schlecht)
||/ Name           Version      Architektur  Beschreibung
+++-==============-============-============-=================================
ii  resolvconf     1.78ubuntu7  all          name server information handler
10
  • Edit your question and show me ls -al /etc/resolv.conf and cat /etc/resolv.conf and systemd-resolve --status (with and without VPN up). Report back. Start comments to me with @heynnema or I may miss them. – heynnema Aug 23 '19 at 14:45
  • @heynnema Question edited by reporting back. – ubuntuuser Aug 23 '19 at 20:51
  • What version Ubuntu? – heynnema Aug 23 '19 at 21:05
  • @heynnema 16.04 LTS – ubuntuuser Aug 23 '19 at 21:10
  • Edit your question and show me ls -al /etc/openvpn – heynnema Aug 23 '19 at 21:15
2

sudo -H gedit /home/myname/thinkpad1/thinkpad1.ovpn # edit this .ovpn file

Add the following to the END of the .ovpn file...

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Save the file and quit gedit.

Retry...

sudo openvpn --config /home/myname/thinkpad1/thinkpad1.ovpn # start VPN

4
  • @ubuntuuser did you change "myname" to your "username"? I assume that you changed that for privacy reasons? – heynnema Aug 23 '19 at 22:01
  • yes. Now everything is fine. – ubuntuuser Aug 23 '19 at 22:02
  • Where did you find this solution? I had to code my own (see my answer) and that has worked for me for a long time. And I'm wondering, does your version also handle things like if they hard power off, and then when they boot up they still have the VPN's dns server in there? – Peter Aug 26 '19 at 7:14
  • @Peter you can compare your connect script with /etc/openvpn/update-resolv-conf and see how close you got. I don't know the answer to your question. If the VPN server goes down, the VPN tunnel is normally closed, and then the reconnect should follow the same path as it did originally. – heynnema Aug 26 '19 at 13:37
0

Is your machine using DHCP? If not, you need to set your dns servers another way.

Also you should verify it's really a dns config issue... like look at your servers with:

$ cat /etc/resolv.conf
...

$ nslookup 
> server
Default server: ... (some ip... if it's your normal non-vpn DNS server, this test fails...it should be something behind the VPN probably)
Address: ...
> 

What I do is... in your configuration file (possibly named client.ovpn), you can add lines like:

script-security 2
route-up connect up
route-pre-down connect down

And then in the script named connect (in the same dir as the ovpn file), you have some code to do what you need... for example:

  • back up the old /etc/resolv.conf (with mv, not cp... otherwise hard power off can damage files)
  • write a new one, maybe with another name and symlink ln -s /etc/resolv.conf.vpn /etc/resolv.conf
  • and also (yuck but not sure how else to do it) enable a shutdown/startup init/rc script that will replace it with the original if you were to uncleanly stop the computer (so the route-pre-down never runs).
  • and also what I do is not include those above 3 lines in the original, and instead my connect without args will append them to a new file and run it like openvpn client.ovpn.generated

And the ugliest part is... for unknown reasons, this doesn't work with one particular machine that also has DHCP that doesn't work properly either, and so the currently used so far problem free but still terrible solution is to do it the same as static like I described, but also chattr +i /etc/resolv.conf in the script, and chattr -i /etc/resolv.conf there and also on the shutdown/startup init/rc script. This is certainly the wrong way, but I haven't found a proper way that complies with usual distro networking scripts. I hope you have better luck than this one machine.

2
  • The result of cat /etc/resolv.conf is now in the edited version of the question. Indeed I don't know if it's a dns config issue, e. g. calling http://8.8.8.8 in the browser fails. – ubuntuuser Aug 23 '19 at 21:08
  • @ubuntuuser As I mentioned in earlier comments... http:// 8.8.8.8 should fail, as that's a DNS server, and doesn't have a web interface. – heynnema Aug 26 '19 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.