This might be a duplicate of this question, but I am not proficient enough in networking matters to tell for sure.

I use a VPN service named Cyberghost to stay private on the internet. After facing DNS leaks when using network-manager I tried using the command line and implement fixes promoted online. Aparantly block-outside-dns works on windows only. Therefore I followed this tutorial and added the lines

script-security 2
up /etc/resolv.conf
down /etc/resolv.conf

to the .ovpn file provided by cyberghost.

When trying to connect using

sudo openvpn --config /home/username/CG/DE/DE.ovpn

however I get the following error:

Options error: --up script fails with '/etc/resolv.conf': Permission denied
Options error: Please correct this error.
Use --help for more information.

Connecting without the up and down command works fine but causes dns leaks. I do not encounter problems manually editing resolv.conf using sudo privilleges therefore I am unsure why openvpn should lack the permission to do so.

Thank you for your thoughts and your help,


System: Kubuntu 17.04

openvpn 2.4.0-4ubuntu1.3

The full .ovpn-file is as follows:


remote 1-de.cg-dialup.net 443

dev tun 

proto udp

auth-user-pass /home/username/CG/DE/auth.txt

resolv-retry infinite 

redirect-gateway def1




cipher AES-256-CBC

auth MD5

ping 5

ping-exit 60


explicit-exit-notify 2

script-security 2

remote-cert-tls server

route-delay 5

tun-mtu 1500 

fragment 1300

mssfix 1300

verb 4


ca /home/username/CG/DE/ca.crt

cert /home/username/CG/DE/client.crt

key /home/username/CG/DE/client.key

script-security 2
up /etc/resolv.conf
down /etc/resolv.conf

Regardless of whether or not this is what you really want or need to do, this bit here:

up /etc/resolv.conf
down /etc/resolv.conf

is not how this functionality works. Rather, the openvpn-systemd-resolved package dynamically updates the file /etc/resolv.conf, by specifying an executable script after the up and down in your openvpn client conf (as per the linked (and incomplete!) "tutorial"). But also, note there are different versions of this functionality; later versions use dbus, which I'm referencing; the previous version just used scripts & temp files. So that's why there's some inconsistency across articles/docs/tutorials.

So, assuming this package is installed (either via apt-get or apt):

sudo apt-get install openvpn-systemd-resolved

and verifying the service is running (if not: enable it and start it manually):

sudo service systemd-resolved status

then, there should be a script installed as /etc/openvpn/update-resolv-conf (or possibly in /etc/openvpn/scripts/ in other distributions) that modifies the /etc/resolv.conf for you.

So your openvpn client conf (which on non-windows clients should by convention have a ".conf" suffix, and they'll automatically be read if in /etc/openvpn; but on windows they typically use .ovpn for proper file association w/ openvpn) -- the openvpn client conf would contain, for example,

script-security 2
setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved

Then you'll noticed that it's the /etc/openvpn/update-systemd-resolved script that needs to be executable (it is by default), and /etc/resolv.conf will be a simple text file that is then updated with correct domain, nameserver, search entries (it's not an executable script).

The last element to tie tis together is to modify /etc/nsswitch.conf to contain something like the following (replacing the existing hosts: entry):

# Use systemd-resolved first, then fall back to /etc/resolv.conf
hosts: files resolve dns myhostname

See the linked update-systemd-resolved github page for details and options.


The only solution I can think of is running

sudo -s

Then running

openvpn --config file.ovpn

If that doesn't work try running

sudo chown root /etc/resolv.conf


sudo chown $USER /etc/resolv.conf

and as a last resort

sudo chmod 777 /etc/resolv.conf

Only use chmod 777 if nothing else works, as it can cause a security hole.

  • Thank you for your Answer! None of your safe methods worked, so I checked what chmod my resolv.conf has so I can revert the changes later. To my astonishment however, it already had 777. I executed your command anyway, unfortunately this did not help :/ I now changed my resolv.conf back to the default 644 for the time being – Alex Aug 21 '17 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.