2

I'm trying to set up a VPN on Ubuntu 18.04.3. Following the suggestions on this question, I added the following lines to the end of the .ovpn file:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

I also ran 

sudo rm -i /etc/resolv.conf

sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf

to fix /etc/resolv.conf.

Then I created the VPN under VPN Settings -> Add VPN -> Open from File, and used the .ovpn file.

However, when I turn the VPN on, the computer still uses the local DNS server, rather than that of the VPN.

Here are the results of various diagnostics, with the VPN on and off:

---------------------------VPN off:------------------------------

cat /run/resolvconf/resolv.conf:

No such file or directory

cat /run/systemd/resolve/resolv.conf:

nameserver 192.168.0.1
nameserver fd08:b55d:5917:0:3e89:94ff:fe31:c148
search Home

cat /run/systemd/resolve/stub-resolv.conf:

nameserver 127.0.0.53
options edns0
search Home

systemd-resolve --status: 

Global
          DNSSEC NTA: 10.in-addr.arpa
                      16.172.in-addr.arpa
                      168.192.in-addr.arpa
                      17.172.in-addr.arpa
                      18.172.in-addr.arpa
                      19.172.in-addr.arpa
                      20.172.in-addr.arpa
                      21.172.in-addr.arpa
                      22.172.in-addr.arpa
                      23.172.in-addr.arpa
                      24.172.in-addr.arpa
                      25.172.in-addr.arpa
                      26.172.in-addr.arpa
                      27.172.in-addr.arpa
                      28.172.in-addr.arpa
                      29.172.in-addr.arpa
                      30.172.in-addr.arpa
                      31.172.in-addr.arpa
                      corp
                      d.f.ip6.arpa
                      home
                      internal
                      intranet
                      lan
                      local
                      private
                      test

Link 2 (wlp59s0)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 192.168.0.1
                      fd08:b55d:5917:0:3e89:94ff:fe31:c148
          DNS Domain: Home

cat /etc/network/interfaces:

 # interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback

cat /etc/netplan/*.yaml:

# Let NetworkManager manage all devices on this system
network:
  version: 2
  renderer: NetworkManager

----------------------------VPN on:------------------------------

cat /run/resolvconf/resolv.conf:

No such file or directory

cat /run/systemd/resolve/resolv.conf: 

nameserver 192.168.0.1
nameserver fd08:b55d:5917:0:3e89:94ff:fe31:c148
nameserver 10.34.16.1
search Home

cat /run/systemd/resolve/stub-resolv.conf: 

nameserver 127.0.0.53
options edns0
search Home

systemd-resolve --status:

Global
          DNSSEC NTA: 10.in-addr.arpa
                      16.172.in-addr.arpa
                      168.192.in-addr.arpa
                      17.172.in-addr.arpa
                      18.172.in-addr.arpa
                      19.172.in-addr.arpa
                      20.172.in-addr.arpa
                      21.172.in-addr.arpa
                      22.172.in-addr.arpa
                      23.172.in-addr.arpa
                      24.172.in-addr.arpa
                      25.172.in-addr.arpa
                      26.172.in-addr.arpa
                      27.172.in-addr.arpa
                      28.172.in-addr.arpa
                      29.172.in-addr.arpa
                      30.172.in-addr.arpa
                      31.172.in-addr.arpa
                      corp
                      d.f.ip6.arpa
                      home
                      internal
                      intranet
                      lan
                      local
                      private
                      test

Link 8 (tun0)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 10.34.16.1

Link 2 (wlp59s0)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 192.168.0.1
                      fd08:b55d:5917:0:3e89:94ff:fe31:c148
          DNS Domain: Home

cat /etc/network/interfaces: 

# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback

cat /etc/netplan/*.yaml: 

# Let NetworkManager manage all devices on this system
network:
  version: 2
  renderer: NetworkManager

EDIT:

ls -al /sbin/resolvconf outputs ls: cannot access '/sbin/resolvconf': No such file or directory.

With the VPN off, host -v www.ebay.com outputs:

Trying "www.ebay.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12728
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.ebay.com.          IN  A

;; ANSWER SECTION:
www.ebay.com.       60  IN  CNAME   slot9428.ebay.com.edgekey.net.
slot9428.ebay.com.edgekey.net. 60 IN    CNAME   e9428.b.akamaiedge.net.
e9428.b.akamaiedge.net. 60  IN  A   104.78.177.101

Received 122 bytes from 192.168.0.1#53 in 14 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 881
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;e9428.b.akamaiedge.net.        IN  AAAA

;; AUTHORITY SECTION:
b.akamaiedge.net.   996 IN  SOA n0b.akamaiedge.net. hostmaster.akamai.com. 1568976151 1000 1000 1000 1800

Received 101 bytes from 192.168.0.1#53 in 12 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30223
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;e9428.b.akamaiedge.net.        IN  MX

;; AUTHORITY SECTION:
b.akamaiedge.net.   1000    IN  SOA n0b.akamaiedge.net. hostmaster.akamai.com. 1568976180 1000 1000 1000 1800

Received 101 bytes from 192.168.0.1#53 in 13 ms

With the VPN on:

Trying "www.ebay.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7665
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.ebay.com.          IN  A

;; ANSWER SECTION:
www.ebay.com.       60  IN  CNAME   slot9428.ebay.com.edgekey.net.
slot9428.ebay.com.edgekey.net. 60 IN    CNAME   e9428.b.akamaiedge.net.
e9428.b.akamaiedge.net. 60  IN  A   104.78.177.101

Received 122 bytes from 192.168.0.1#53 in 15 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1414
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;e9428.b.akamaiedge.net.        IN  AAAA

;; AUTHORITY SECTION:
b.akamaiedge.net.   999 IN  SOA n0b.akamaiedge.net. hostmaster.akamai.com. 1568976217 1000 1000 1000 1800

Received 101 bytes from 192.168.0.1#53 in 12 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6348
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;e9428.b.akamaiedge.net.        IN  MX

;; AUTHORITY SECTION:
b.akamaiedge.net.   994 IN  SOA n0b.akamaiedge.net. hostmaster.akamai.com. 1568976219 1000 1000 1000 1800

Received 101 bytes from 192.168.0.1#53 in 19 ms

EDIT 2: After running sudo apt-get install resolvconf, the output of host -v www.ebay.com, with the VPN on, becomes:

Trying "www.ebay.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9033
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.ebay.com.          IN  A

;; ANSWER SECTION:
www.ebay.com.       60  IN  CNAME   slot9428.ebay.com.edgekey.net.
slot9428.ebay.com.edgekey.net. 59 IN    CNAME   e9428.b.akamaiedge.net.
e9428.b.akamaiedge.net. 59  IN  A   104.78.177.101

Received 122 bytes from 127.0.0.53#53 in 57 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19716
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;e9428.b.akamaiedge.net.        IN  AAAA

Received 40 bytes from 127.0.0.53#53 in 15 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48908
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;e9428.b.akamaiedge.net.        IN  MX

Received 40 bytes from 127.0.0.53#53 in 21 ms

EDIT 3:

The output of cat /etc/resolv.conf and cat /run/resolvconf/resolv.conf is the same, and is:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "systemd-resolve --status" to see details about the actual nameservers.

nameserver 127.0.0.53
search Home

EDIT 4: Calling grep -r '192.168.0.1' /etc/ returns: 

/etc/sane.d/saned.conf:#192.168.0.1
/etc/sane.d/saned.conf:#192.168.0.1/29
/etc/sane.d/magicolor.conf:# net 192.168.0.1
/etc/avahi/hosts:# 192.168.0.1 router.local

With the VPN turned on via the Network Manager GUI (i.e., from the top menu), the output of systemd-resolve --status is:

Global
          DNS Domain: Home
          DNSSEC NTA: 10.in-addr.arpa
                      16.172.in-addr.arpa
                      168.192.in-addr.arpa
                      17.172.in-addr.arpa
                      18.172.in-addr.arpa
                      19.172.in-addr.arpa
                      20.172.in-addr.arpa
                      21.172.in-addr.arpa
                      22.172.in-addr.arpa
                      23.172.in-addr.arpa
                      24.172.in-addr.arpa
                      25.172.in-addr.arpa
                      26.172.in-addr.arpa
                      27.172.in-addr.arpa
                      28.172.in-addr.arpa
                      29.172.in-addr.arpa
                      30.172.in-addr.arpa
                      31.172.in-addr.arpa
                      corp
                      d.f.ip6.arpa
                      home
                      internal
                      intranet
                      lan
                      local
                      private
                      test

Link 13 (tun0)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 10.34.40.1

Link 2 (wlp59s0)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 192.168.0.1
                      fd08:b55d:5917:0:3e89:94ff:fe31:c148
          DNS Domain: Home

Calling the VPN via sudo openvpn seems to work correctly: The output of systemd-resolve --status is:

Global
         DNS Servers: 10.34.48.1
          DNS Domain: Home
          DNSSEC NTA: 10.in-addr.arpa
                      16.172.in-addr.arpa
                      168.192.in-addr.arpa
                      17.172.in-addr.arpa
                      18.172.in-addr.arpa
                      19.172.in-addr.arpa
                      20.172.in-addr.arpa
                      21.172.in-addr.arpa
                      22.172.in-addr.arpa
                      23.172.in-addr.arpa
                      24.172.in-addr.arpa
                      25.172.in-addr.arpa
                      26.172.in-addr.arpa
                      27.172.in-addr.arpa
                      28.172.in-addr.arpa
                      29.172.in-addr.arpa
                      30.172.in-addr.arpa
                      31.172.in-addr.arpa
                      corp
                      d.f.ip6.arpa
                      home
                      internal
                      intranet
                      lan
                      local
                      private
                      test

Link 14 (tun0)
      Current Scopes: none
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no

Link 2 (wlp59s0)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 192.168.0.1
                      fd08:b55d:5917:0:3e89:94ff:fe31:c148
          DNS Domain: Home

dnsleak.com shows the VPN's DNS server, and host -v www.ebay.com gets its data from 10.34.48.1.

Two interesting output lines from the initialization of the VPN from the terminal are:

/etc/openvpn/update-resolv-conf tun0 1500 1553 10.34.48.8 255.255.252.0 init
dhcp-option DNS 10.34.48.1

It looks like maybe the openvpn command is changing the dhcp-option, but the network manager is not.

Improve this question
14
  • Actually... it does. DNS Servers: 10.34.16.1 Each link in SystemD's ResolveD can carry its own assigned DNS servers, it uses them in the order shown from first link to last (first come first tested) through to the end to run DNS queries. It won't change the DNS entries in resolv.conf, no, but that's becuase the resolv.conf points at systemd-resolved which handles DNS queries outbound internally to itself.
    – Thomas Ward -On Strike ♦
    Sep 19, 2019 at 16:27
  • Thanks for copying over all of the data from our previous discussion. Show me ls -al /sbin/resolvconf and with vpn down/up host -v www.ebay.com.
    – heynnema
    Sep 19, 2019 at 21:12
  • I added the two other outputs. It looks like it's still not using the new DNS server because the 192.168.0.1 is still first, so I'm still getting DNS leaks.
    – Sam Jaques
    Sep 20, 2019 at 10:47
  • Make sure to start comments to me with @heynnema or I'll surely miss them. Thanks for the updates to my questions. Install this sudo apt-get install resolvconf, then reboot, and retry the systemd-resolve --status command with vpn up. Recheck the host -v command, and check for DNS leaks. Report back.
    – heynnema
    Sep 20, 2019 at 14:22
  • @ThomasWard actually, it's not working correctly, as seen by the host -v command, and the dns leaks.
    – heynnema
    Sep 20, 2019 at 14:24

1 Answer 1

Reset to default
0

DNSoverTLS 1.1.1.1 OpenVPN configuration.

First you need systemd-resolved installed and configured to use stub-resolv.conf.

ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
cat /etc/resolv.conf

Output

nameserver 127.0.0.53
options edns0

systemd-networkd

/etc/systemd/resolved.conf (example):

[Resolve]
DNS=8.8.8.8 8.8.4.4
FallbackDNS=1.1.1.1 1.0.0.1
LLMNR=no
MulticastDNS=no
DNSSEC=allow-downgrade
DNSOverTLS=opportunistic
Cache=yes
DNSStubListener=yes

/etc/systemd/network/ethX.network (example):

[Match]
Name=eth*

[Link]
RequiredForOnline=yes

[Network]
DHCP=yes
MulticastDNS=no
LLMNR=no
LinkLocalAddressing=no

[DHCP]
UseDNS=yes
UseHostname=no
CriticalConnection=yes

/etc/systemd/network/tunX.network (important!):

(in order for openvpn to be able to administer tun link, the link must be unmanaged)

[Match]
Name=tun*

[Link]
Unmanaged=yes

I use update-resolved to configure systemd-resolved. (you can use update-systemd-resolved or aptitude install openvpn-systemd-resolved, but when you need to follow README.md instead).

Installing update-resolved:

cd /etc/openvpn
git clone https://github.com/bac0n/update-resolved.git

Add update-resolved to your openvpn.conf:

# Include update-resolved up/down script.
config /etc/openvpn/update-resolved/update-resolved.ovpn

Restart openvpn:

systemctl restart openvpn

Journald:

journalctl -t update-resolved

Output

-- Logs begin at Sat 2019-09-21 12:28:01 CEST, end at Sun 2019-09-22 17:05:01 CEST. --
Sep 21 12:28:11 foobar update-resolved[914]: Note: Successfully configured resolved on link 3 (tun0)

Note:

As default it uses openvpn supplied dns´s. if you like to use static dns´s you need to filter the dns´s supplied by openvpn in 'update-resolved.ovpn' and set your own dns´s in 'update-resolved.conf'

Example:

resolve_options=(DOMAIN ~. DNS 1.1.1.1 DNS 1.0.0.1 LLMNR no MulticastDNS no)

(when using domain ~. resolved will use the tun link for all your dns queries (unless other too carry such a route-only domain). When the tun link is removed resolved will start using 'global' and 'isp' dns´s in parallel, Protocols and Routing)

Improve this answer
2
  • systemd is installed and the /etc/resolv.conf link is fixed. For both /etc/systemd/network/ethX.network and /etc/systemd/network/tunX.network, I get "No such file or directory". Are those files important to have?
    – Sam Jaques
    Sep 22, 2019 at 9:47
  • no, you can check if your tun interface is unmanaged with networkctl
    – user986805
    Sep 22, 2019 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.