I'm trying to set up a VPN on Ubuntu 18.04.3. Following the suggestions on this question, I added the following lines to the end of the .ovpn file:
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
I also ran
sudo rm -i /etc/resolv.conf
sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
to fix /etc/resolv.conf.
Then I created the VPN under VPN Settings -> Add VPN -> Open from File, and used the .ovpn file.
However, when I turn the VPN on, the computer still uses the local DNS server, rather than that of the VPN.
Here are the results of various diagnostics, with the VPN on and off:
—————————VPN off:——————————
cat /run/resolvconf/resolv.conf:
No such file or directory
cat /run/systemd/resolve/resolv.conf:
nameserver 192.168.0.1
nameserver fd08:b55d:5917:0:3e89:94ff:fe31:c148
search Home
cat /run/systemd/resolve/stub-resolv.conf:
nameserver 127.0.0.53
options edns0
search Home
systemd-resolve –status:
Global
DNSSEC NTA: 10.in-addr.arpa
16.172.in-addr.arpa
168.192.in-addr.arpa
17.172.in-addr.arpa
18.172.in-addr.arpa
19.172.in-addr.arpa
20.172.in-addr.arpa
21.172.in-addr.arpa
22.172.in-addr.arpa
23.172.in-addr.arpa
24.172.in-addr.arpa
25.172.in-addr.arpa
26.172.in-addr.arpa
27.172.in-addr.arpa
28.172.in-addr.arpa
29.172.in-addr.arpa
30.172.in-addr.arpa
31.172.in-addr.arpa
corp
d.f.ip6.arpa
home
internal
intranet
lan
local
private
test
Link 2 (wlp59s0)
Current Scopes: DNS
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
DNS Servers: 192.168.0.1
fd08:b55d:5917:0:3e89:94ff:fe31:c148
DNS Domain: Home
cat /etc/network/interfaces:
# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
cat /etc/netplan/*.yaml:
# Let NetworkManager manage all devices on this system
network:
version: 2
renderer: NetworkManager
—————————-VPN on:——————————
cat /run/resolvconf/resolv.conf:
No such file or directory
cat /run/systemd/resolve/resolv.conf:
nameserver 192.168.0.1
nameserver fd08:b55d:5917:0:3e89:94ff:fe31:c148
nameserver 10.34.16.1
search Home
cat /run/systemd/resolve/stub-resolv.conf:
nameserver 127.0.0.53
options edns0
search Home
systemd-resolve –status:
Global
DNSSEC NTA: 10.in-addr.arpa
16.172.in-addr.arpa
168.192.in-addr.arpa
17.172.in-addr.arpa
18.172.in-addr.arpa
19.172.in-addr.arpa
20.172.in-addr.arpa
21.172.in-addr.arpa
22.172.in-addr.arpa
23.172.in-addr.arpa
24.172.in-addr.arpa
25.172.in-addr.arpa
26.172.in-addr.arpa
27.172.in-addr.arpa
28.172.in-addr.arpa
29.172.in-addr.arpa
30.172.in-addr.arpa
31.172.in-addr.arpa
corp
d.f.ip6.arpa
home
internal
intranet
lan
local
private
test
Link 8 (tun0)
Current Scopes: DNS
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
DNS Servers: 10.34.16.1
Link 2 (wlp59s0)
Current Scopes: DNS
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
DNS Servers: 192.168.0.1
fd08:b55d:5917:0:3e89:94ff:fe31:c148
DNS Domain: Home
cat /etc/network/interfaces:
# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
cat /etc/netplan/*.yaml:
# Let NetworkManager manage all devices on this system
network:
version: 2
renderer: NetworkManager
EDIT:
ls -al /sbin/resolvconf outputs ls: cannot access '/sbin/resolvconf': No such file or directory.
With the VPN off, host -v www.ebay.com outputs:
Trying "www.ebay.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12728
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.ebay.com. IN A
;; ANSWER SECTION:
www.ebay.com. 60 IN CNAME slot9428.ebay.com.edgekey.net.
slot9428.ebay.com.edgekey.net. 60 IN CNAME e9428.b.akamaiedge.net.
e9428.b.akamaiedge.net. 60 IN A 104.78.177.101
Received 122 bytes from 192.168.0.1#53 in 14 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 881
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;e9428.b.akamaiedge.net. IN AAAA
;; AUTHORITY SECTION:
b.akamaiedge.net. 996 IN SOA n0b.akamaiedge.net. hostmaster.akamai.com. 1568976151 1000 1000 1000 1800
Received 101 bytes from 192.168.0.1#53 in 12 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30223
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;e9428.b.akamaiedge.net. IN MX
;; AUTHORITY SECTION:
b.akamaiedge.net. 1000 IN SOA n0b.akamaiedge.net. hostmaster.akamai.com. 1568976180 1000 1000 1000 1800
Received 101 bytes from 192.168.0.1#53 in 13 ms
With the VPN on:
Trying "www.ebay.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7665
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.ebay.com. IN A
;; ANSWER SECTION:
www.ebay.com. 60 IN CNAME slot9428.ebay.com.edgekey.net.
slot9428.ebay.com.edgekey.net. 60 IN CNAME e9428.b.akamaiedge.net.
e9428.b.akamaiedge.net. 60 IN A 104.78.177.101
Received 122 bytes from 192.168.0.1#53 in 15 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1414
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;e9428.b.akamaiedge.net. IN AAAA
;; AUTHORITY SECTION:
b.akamaiedge.net. 999 IN SOA n0b.akamaiedge.net. hostmaster.akamai.com. 1568976217 1000 1000 1000 1800
Received 101 bytes from 192.168.0.1#53 in 12 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6348
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;e9428.b.akamaiedge.net. IN MX
;; AUTHORITY SECTION:
b.akamaiedge.net. 994 IN SOA n0b.akamaiedge.net. hostmaster.akamai.com. 1568976219 1000 1000 1000 1800
Received 101 bytes from 192.168.0.1#53 in 19 ms
EDIT 2: After running sudo apt-get install resolvconf, the output of host -v www.ebay.com, with the VPN on, becomes:
Trying "www.ebay.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9033
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.ebay.com. IN A
;; ANSWER SECTION:
www.ebay.com. 60 IN CNAME slot9428.ebay.com.edgekey.net.
slot9428.ebay.com.edgekey.net. 59 IN CNAME e9428.b.akamaiedge.net.
e9428.b.akamaiedge.net. 59 IN A 104.78.177.101
Received 122 bytes from 127.0.0.53#53 in 57 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19716
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;e9428.b.akamaiedge.net. IN AAAA
Received 40 bytes from 127.0.0.53#53 in 15 ms
Trying "e9428.b.akamaiedge.net"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48908
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;e9428.b.akamaiedge.net. IN MX
Received 40 bytes from 127.0.0.53#53 in 21 ms
EDIT 3:
The output of cat /etc/resolv.conf and cat /run/resolvconf/resolv.conf is the same, and is:
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "systemd-resolve --status" to see details about the actual nameservers.
nameserver 127.0.0.53
search Home
EDIT 4: Calling grep -r '192.168.0.1' /etc/ returns:
/etc/sane.d/saned.conf:#192.168.0.1
/etc/sane.d/saned.conf:#192.168.0.1/29
/etc/sane.d/magicolor.conf:# net 192.168.0.1
/etc/avahi/hosts:# 192.168.0.1 router.local
With the VPN turned on via the Network Manager GUI (i.e., from the top menu), the output of systemd-resolve --status is:
Global
DNS Domain: Home
DNSSEC NTA: 10.in-addr.arpa
16.172.in-addr.arpa
168.192.in-addr.arpa
17.172.in-addr.arpa
18.172.in-addr.arpa
19.172.in-addr.arpa
20.172.in-addr.arpa
21.172.in-addr.arpa
22.172.in-addr.arpa
23.172.in-addr.arpa
24.172.in-addr.arpa
25.172.in-addr.arpa
26.172.in-addr.arpa
27.172.in-addr.arpa
28.172.in-addr.arpa
29.172.in-addr.arpa
30.172.in-addr.arpa
31.172.in-addr.arpa
corp
d.f.ip6.arpa
home
internal
intranet
lan
local
private
test
Link 13 (tun0)
Current Scopes: DNS
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
DNS Servers: 10.34.40.1
Link 2 (wlp59s0)
Current Scopes: DNS
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
DNS Servers: 192.168.0.1
fd08:b55d:5917:0:3e89:94ff:fe31:c148
DNS Domain: Home
Calling the VPN via sudo openvpn seems to work correctly: The output of systemd-resolve --status is:
Global
DNS Servers: 10.34.48.1
DNS Domain: Home
DNSSEC NTA: 10.in-addr.arpa
16.172.in-addr.arpa
168.192.in-addr.arpa
17.172.in-addr.arpa
18.172.in-addr.arpa
19.172.in-addr.arpa
20.172.in-addr.arpa
21.172.in-addr.arpa
22.172.in-addr.arpa
23.172.in-addr.arpa
24.172.in-addr.arpa
25.172.in-addr.arpa
26.172.in-addr.arpa
27.172.in-addr.arpa
28.172.in-addr.arpa
29.172.in-addr.arpa
30.172.in-addr.arpa
31.172.in-addr.arpa
corp
d.f.ip6.arpa
home
internal
intranet
lan
local
private
test
Link 14 (tun0)
Current Scopes: none
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
Link 2 (wlp59s0)
Current Scopes: DNS
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: no
DNSSEC supported: no
DNS Servers: 192.168.0.1
fd08:b55d:5917:0:3e89:94ff:fe31:c148
DNS Domain: Home
dnsleak.com shows the VPN's DNS server, and host -v www.ebay.com gets its data from 10.34.48.1.
Two interesting output lines from the initialization of the VPN from the terminal are:
/etc/openvpn/update-resolv-conf tun0 1500 1553 10.34.48.8 255.255.252.0 init
dhcp-option DNS 10.34.48.1
It looks like maybe the openvpn command is changing the dhcp-option, but the network manager is not.
Best Answer
DNSoverTLS 1.1.1.1 OpenVPN configuration.
First you need systemd-resolved installed and configured to use stub-resolv.conf.
Output
systemd-networkd
/etc/systemd/resolved.conf (example):
/etc/systemd/network/ethX.network (example):
/etc/systemd/network/tunX.network (important!):
(in order for openvpn to be able to administer tun link, the link must be unmanaged)
I use update-resolved to configure systemd-resolved. (you can use update-systemd-resolved or aptitude install openvpn-systemd-resolved, but when you need to follow README.md instead).
Installing update-resolved:
Add update-resolved to your openvpn.conf:
Restart openvpn:
Journald:
Output
Note:
As default it uses openvpn supplied dns´s. if you like to use static dns´s you need to filter the dns´s supplied by openvpn in 'update-resolved.ovpn' and set your own dns´s in 'update-resolved.conf'
Example:
(when using domain ~. resolved will use the tun link for all your dns queries (unless other too carry such a route-only domain). When the tun link is removed resolved will start using 'global' and 'isp' dns´s in parallel, Protocols and Routing)