resolv.conf empty after disconnecting vpn

kevincw01

When I connect to the vpn server with openvpn 2.3.2 on centos 6, everything works fine until I disconnect. Then I no longer have any DNS. I noticed that resolv.conf no longer looks like it did before I connected. As a result, openvpn cannot reconnect unless I restore resolv.conf or reboot. I do notice some errors in the startup log but googling those errors didn't help. Any tips to resolve this problem would be appreciated.

The following is the client config. I unfortunately do not have access to the server config.

client
dev tun0
proto udp
remote pw.openvpn.ipredator.se 1194
remote pw.openvpn.ipredator.me 1194
remote pw.openvpn.ipredator.es 1194
resolv-retry infinite
nobind
auth-user-pass /etc/openvpn/IPredator.auth
auth-retry nointeract
ca [inline]
tls-client
tls-auth [inline]
ns-cert-type server
keepalive 10 30
cipher AES-256-CBC
persist-key
persist-tun
comp-lzo
tun-mtu 1500
mssfix
passtos
verb 3
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
<ca>
-----BEGIN CERTIFICATE-----<snip>

update-resolv-conf:

[ -x /sbin/resolvconf ] || exit 0                                                                                                                                                                                                            
case $script_type in
up)
        for optionname in ${!foreign_option_*} ; do
                option="${!optionname}"
                echo $option
                part1=$(echo "$option" | cut -d " " -f 1)
                if [ "$part1" == "dhcp-option" ] ; then
                        part2=$(echo "$option" | cut -d " " -f 2)
                        part3=$(echo "$option" | cut -d " " -f 3)
                        if [ "$part2" == "DNS" ] ; then
                                IF_DNS_NAMESERVERS="$IF_DNS_NAMESERVERS $part3"
                        fi
                        if [ "$part2" == "DOMAIN" ] ; then
                                IF_DNS_SEARCH="$part3"
                        fi
                fi
        done
        R=""
        if [ "$IF_DNS_SEARCH" ] ; then
                R="${R}search $IF_DNS_SEARCH\n"
        fi
        for NS in $IF_DNS_NAMESERVERS ; do
                R="${R}nameserver $NS\n"
        done
        echo -n "$R" | /sbin/resolvconf -a "${dev}.inet"
        ;;
down)
        /sbin/resolvconf -d "${dev}.inet"
        ;;
esac

client VPN connect log:

[root@localhost ~]# openvpn --config /etc/openvpn/vpn.conf
Sun Apr  6 20:03:02 2014 OpenVPN 2.3.2 i686-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Sep 12 2013
Sun Apr  6 20:03:02 2014 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Apr  6 20:03:02 2014 Control Channel Authentication: tls-auth using INLINE static key file
Sun Apr  6 20:03:02 2014 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Apr  6 20:03:02 2014 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Apr  6 20:03:02 2014 Socket Buffers: R=[112640->131072] S=[112640->131072]
Sun Apr  6 20:03:02 2014 UDPv4 link local: [undef]
Sun Apr  6 20:03:02 2014 UDPv4 link remote: [AF_INET]X.X.33.2:1194
Sun Apr  6 20:03:03 2014 TLS: Initial packet from [AF_INET]X.X.33.2:1194, sid=f1791bef ea496673
Sun Apr  6 20:03:03 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Apr  6 20:03:04 2014 VERIFY OK: depth=1, C=SE, ST=<SNIP>
Sun Apr  6 20:03:04 2014 VERIFY OK: nsCertType=SERVER
Sun Apr  6 20:03:04 2014 VERIFY OK: depth=0, C=SE, ST=<SNIP>
Sun Apr  6 20:03:06 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Apr  6 20:03:06 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Apr  6 20:03:06 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Apr  6 20:03:06 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Apr  6 20:03:06 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Apr  6 20:03:06 2014 [X.Y.Z.XX] Peer Connection Initiated with [AF_INET]X.X.33.2:1194
Sun Apr  6 20:03:08 2014 SENT CONTROL [X.Y.Z.XX]: 'PUSH_REQUEST' (status=1)
Sun Apr  6 20:03:08 2014 PUSH: Received control message: 'PUSH_REPLY,route X.X.33.2 255.255.255.255 net_gateway,route-gateway X.X.33.1,redirect-gateway def1,topology subnet,dhcp-option DOMAIN Z.XX,dhcp-option DNS X.X.46.46,dhcp-option DNS X.X.32.23,ip-win32 dynamic,ping 10,ping-restart 60,auth-retry nointeract,ifconfig X.X.33.110 255.255.255.0'
Sun Apr  6 20:03:08 2014 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:8: ip-win32 (2.3.2)
Sun Apr  6 20:03:08 2014 Options error: option 'auth-retry' cannot be used in this context ([PUSH-OPTIONS])
Sun Apr  6 20:03:08 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Apr  6 20:03:08 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sun Apr  6 20:03:08 2014 OPTIONS IMPORT: route options modified
Sun Apr  6 20:03:08 2014 OPTIONS IMPORT: route-related options modified
Sun Apr  6 20:03:08 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Apr  6 20:03:08 2014 WARNING: potential conflict between --remote address [X.X.33.2] and --ifconfig address pair [X.X.33.110, 255.255.255.0] -- this is a warning only that is triggered when local/remote addresses exist within the same /24 subnet as --ifconfig endpoints. (silence this warning with --ifconfig-nowarn)
Sun Apr  6 20:03:08 2014 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=eth0 HWADDR=XX:XX:XX:XX:XX:XX
Sun Apr  6 20:03:08 2014 TUN/TAP device tun0 opened
Sun Apr  6 20:03:08 2014 TUN/TAP TX queue length set to 100
Sun Apr  6 20:03:08 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Apr  6 20:03:08 2014 /sbin/ip link set dev tun0 up mtu 1500
Sun Apr  6 20:03:08 2014 /sbin/ip addr add dev tun0 X.X.33.110/24 broadcast X.X.33.255
Sun Apr  6 20:03:08 2014 /etc/openvpn/update-resolv-conf tun0 1500 1558 X.X.33.110 255.255.255.0 init
dhcp-option DOMAIN Z.XX
dhcp-option DNS X.X.46.46
dhcp-option DNS X.X.32.23
Sun Apr  6 20:03:09 2014 /sbin/ip route add X.X.33.2/32 via 192.168.0.1
Sun Apr  6 20:03:09 2014 /sbin/ip route add 0.0.0.0/1 via X.X.33.1
Sun Apr  6 20:03:09 2014 /sbin/ip route add 128.0.0.0/1 via X.X.33.1
Sun Apr  6 20:03:09 2014 /sbin/ip route add X.X.33.2/32 via 192.168.0.1
RTNETLINK answers: File exists
Sun Apr  6 20:03:09 2014 ERROR: Linux route add command failed: external program exited with error status: 2
Sun Apr  6 20:03:09 2014 Initialization Sequence Completed
Sun Apr  6 21:03:07 2014 VERIFY OK: depth=1, C=SE, <SNIP>
Sun Apr  6 21:03:07 2014 VERIFY OK: nsCertType=SERVER
Sun Apr  6 21:03:07 2014 VERIFY OK: depth=0, C=SE, <SNIP>
Sun Apr  6 21:03:09 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Apr  6 21:03:09 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Apr  6 21:03:09 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Apr  6 21:03:09 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Apr  6 21:03:09 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

Disconnect from VPN log:

Sun Apr  6 21:58:14 2014 event_wait : Interrupted system call (code=4)
Sun Apr  6 21:58:14 2014 /sbin/ip route del X.X.33.2/32
Sun Apr  6 21:58:14 2014 /sbin/ip route del 0.0.0.0/1
Sun Apr  6 21:58:14 2014 /sbin/ip route del 128.0.0.0/1
Sun Apr  6 21:58:14 2014 Closing TUN/TAP interface
Sun Apr  6 21:58:14 2014 /sbin/ip addr del dev tun0 X.X.33.110/24
Sun Apr  6 21:58:14 2014 /etc/openvpn/update-resolv-conf tun0 1500 1558 X.X.33.110 255.255.255.0 init
Sun Apr  6 21:58:14 2014 SIGINT[hard,] received, process exiting

/etc/resolv.conf before connecting VPN

# Generated by NetworkManager
nameserver X.X.47.61
nameserver X.X.47.62

/etc/resolv.conf after connecting VPN

# Generated by resolvconf
search Z.XX
nameserver X.X.46.46
nameserver X.X.32.23

/etc/resolv.conf after disconnecting VPN

# Generated by resolvconf

kevincw01

well I came up with a solution but I'm not sure it's the right way to do it. I was inspired by http://serverfault.com/questions/528773/networkmanager-is-not-changing-etc-resolve-conf-after-openvpn-dns-push. Essentially I modified the update-resolv-conf script to just make a copy of the original /etc/resolv.conf during "up" and then copy it back during "down".

#!/bin/bash
#
# Parses DHCP options from openvpn to update resolv.conf
# To use set as 'up' and 'down' script in your openvpn *.conf:
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
#
# Used snippets of resolvconf script by Thomas Hood <jdthood@yahoo.co.uk>
# and Chris Hanson
# Licensed under the GNU GPL.  See /usr/share/common-licenses/GPL.
# 04/2014 k@cwill.org fixed empty resolv.conf after VPN is down'd
# 07/2013 colin@daedrum.net Fixed intet name
# 05/2006 chlauber@bnc.ch
#
# Example envs set from openvpn:
# foreign_option_1='dhcp-option DNS 193.43.27.132'
# foreign_option_2='dhcp-option DNS 193.43.27.133'
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'
# foreign_option_4='dhcp-option DOMAIN-SEARCH bnc.local'

set -e

## You might need to set the path manually here, i.e.
RESOLVCONF="/sbin/resolvconf"
#RESOLVCONF=$(which resolvconf)
[ -x $RESOLVCONF ] || exit 0

case $script_type in

up)
   for optionname in ${!foreign_option_*} ; do
      option="${!optionname}"
      echo $option
      part1=$(echo "$option" | cut -d " " -f 1)
      if [ "$part1" == "dhcp-option" ] ; then
         part2=$(echo "$option" | cut -d " " -f 2)
         part3=$(echo "$option" | cut -d " " -f 3)
         if [ "$part2" == "DNS" ] ; then
            IF_DNS_NAMESERVERS="$IF_DNS_NAMESERVERS $part3"
         fi
         if [[ "$part2" == "DOMAIN" || "$part2" == "DOMAIN-SEARCH" ]] ; then
            IF_DNS_SEARCH="$IF_DNS_SEARCH $part3"
         fi
      fi
   done
   R=""
   for DS in $IF_DNS_SEARCH ; do
           R="${R}search $DS
"
   done
   for NS in $IF_DNS_NAMESERVERS ; do
           R="${R}nameserver $NS
"
   done
   cp /etc/resolv.conf /etc/resolv.conf.default
   #echo -n "$R" | $RESOLVCONF -p -a "${dev}"
   echo -n "$R" | $RESOLVCONF -a "${dev}.inet"
   ;;
down)
   $RESOLVCONF -d "${dev}.inet"
   mv -f /etc/resolv.conf.default /etc/resolv.conf
   ;;
esac