[Solved] Ubuntu DNS on client not working when launching from shell

rushd

I did a little searching and I couldn't find any information in regards to this issue. I am using a VPN service to anonymize my internet traffic and they provided me with a opvpn file. This file works from the GUI on my Ubuntu client after importing into the network manager without issue. However if I launch from the shell the DNS information does not populate. One thing I have noticed is that when I launch it from the GUI network manager it creates two interfaces tun0 with the IP information and another they name of the VPN configuration that includes the IP information as well as the DNS. I don't have access to the server configuration files. Below is the client configuration as well as the messages as it connects via the shell. As you will see the server is pushing DNS servers when connecting. I have also tried adding the DNS servers to the client.conf and that did not change the issue.

Client is Ubuntu 16.04.1 LTS

client
dev tun
proto udp
remote VPN_PROVIDER_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
persist-remote-ip
#ca vpn.crt

tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 3

auth SHA256
cipher AES-256-CBC

<ca>
-----BEGIN CERTIFICATE-----
XXX
-----END CERTIFICATE-----
</ca>

sudo openvpn --client --config /etc/openvpn/client.conf

Tue Jul 26 16:26:49 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
Tue Jul 26 16:26:49 2016 library versions: OpenSSL 1.0.2g-fips  1 Mar 2016, LZO 2.08
Enter Auth Username: *******************
Enter Auth Password: **********
Tue Jul 26 16:27:05 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Jul 26 16:27:06 2016 UDPv4 link local: [undef]
Tue Jul 26 16:27:06 2016 UDPv4 link remote: [AF_INET]VPN_PROVIDER_IP:1194
Tue Jul 26 16:27:06 2016 TLS: Initial packet from [AF_INET]VPN_PROVIDER_IP:1194, sid=c61b7353 25c11b56
Tue Jul 26 16:27:06 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jul 26 16:27:06 2016 VERIFY OK: depth=1, C=US, ST=VPN, L=VPN, O=VPN, OU=VPN, CN=VPN, name=VPN, emailAddress=VPN
Tue Jul 26 16:27:06 2016 Validating certificate key usage
Tue Jul 26 16:27:06 2016 ++ Certificate has key usage  00a0, expects 00a0
Tue Jul 26 16:27:06 2016 VERIFY KU OK
Tue Jul 26 16:27:06 2016 Validating certificate extended key usage
Tue Jul 26 16:27:06 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Jul 26 16:27:06 2016 VERIFY EKU OK
Tue Jul 26 16:27:06 2016 VERIFY OK: depth=0, C=US, ST=VPN, L=VPN, O=VPN, OU=VPN, CN=vpn, name=VPN
Tue Jul 26 16:27:06 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 26 16:27:06 2016 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Jul 26 16:27:06 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 26 16:27:06 2016 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Jul 26 16:27:06 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Jul 26 16:27:06 2016 [vpn] Peer Connection Initiated with [AF_INET]209.197.6.142:1194
Tue Jul 26 16:27:09 2016 SENT CONTROL [vpn]: 'PUSH_REQUEST' (status=1)
Tue Jul 26 16:27:09 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 198.18.0.1,dhcp-option DNS 198.18.0.2,rcvbuf 262144,explicit-exit-notify 5,route-gateway 172.21.90.1,topology subnet,ping 20,ping-restart 40,ifconfig 172.21.90.7 255.255.254.0'
Tue Jul 26 16:27:09 2016 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jul 26 16:27:09 2016 OPTIONS IMPORT: explicit notify parm(s) modified
Tue Jul 26 16:27:09 2016 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Tue Jul 26 16:27:09 2016 Socket Buffers: R=[212992->425984] S=[212992->212992]
Tue Jul 26 16:27:09 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jul 26 16:27:09 2016 OPTIONS IMPORT: route options modified
Tue Jul 26 16:27:09 2016 OPTIONS IMPORT: route-related options modified
Tue Jul 26 16:27:09 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Jul 26 16:27:09 2016 ROUTE_GATEWAY 10.0.0.1/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:56:38:d7
Tue Jul 26 16:27:09 2016 TUN/TAP device tun0 opened
Tue Jul 26 16:27:09 2016 TUN/TAP TX queue length set to 100
Tue Jul 26 16:27:09 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jul 26 16:27:09 2016 /sbin/ip link set dev tun0 up mtu 1500
Tue Jul 26 16:27:09 2016 /sbin/ip addr add dev tun0 172.21.90.7/23 broadcast 172.21.91.255
Tue Jul 26 16:27:09 2016 /sbin/ip route add 209.197.6.142/32 via 10.0.0.1
Tue Jul 26 16:27:09 2016 /sbin/ip route add 0.0.0.0/1 via 172.21.90.1
Tue Jul 26 16:27:09 2016 /sbin/ip route add 128.0.0.0/1 via 172.21.90.1
Tue Jul 26 16:27:09 2016 Initialization Sequence Completed

TinCanTech

rushd wrotemy Ubuntu client

rushd wroteif I launch from the shell the DNS information does not populate

You need these two scripts used with --up & --down, to update DNS servers:
https://github.com/OpenVPN/openvpn/tree/master/contrib/pull-resolv-conf

rushd

TinCanTech wrote
rushd wrotemy Ubuntu client
rushd wroteif I launch from the shell the DNS information does not populate
You need these two scripts used with --up & --down, to update DNS servers:
https://github.com/OpenVPN/openvpn/tree/master/contrib/pull-resolv-conf

I updated the configuration as best as I could. Sounds like I also need to use down-root plugin with the down script, so I added that as well. It seems as though I am having an issue with the up script executing.

Here is my client.cong

client
up /etc/openvpn/client.up
plugin /usr/lib/openvpn/openvpn-plugin-down-root.so "/etc/openvpn/client.down"
dev tun
proto udp
remote VPN_PROVIDER_SERVER 1194
resolv-retry infinite
nobind
persist-key
persist-tun
persist-remote-ip
#ca vpn.crt

tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 3

auth SHA256
cipher AES-256-CBC

<ca>
-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----
</ca>

Here is the up script

#!/bin/sh

# Copyright (c) 2005-2010 OpenVPN Technologies, Inc.
# Licensed under the GPL version 2

# First version by Jesse Adelman
# someone at boldandbusted dink com
# http://www.boldandbusted.com/

# PURPOSE: This script automatically sets the proper /etc/resolv.conf entries
# as pulled down from an OpenVPN server.

# INSTALL NOTES:
# Place this in /etc/openvpn/client.up
# Then, add the following to your /etc/openvpn/<clientconfig>.conf:
#   client
#   up /etc/openvpn/client.up
# Next, "chmod a+x /etc/openvpn/client.up"

# USAGE NOTES:
# Note that this script is best served with the companion "client.down"
# script.

# Tested under Debian lenny with OpenVPN 2.1_rc11
# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf

# This runs with the context of the OpenVPN UID/GID 
# at the time of execution. This generally means that
# the client "up" script will run fine, but the "down" script
# will require the use of the OpenVPN "down-root" plugin
# which is in the plugins/ directory of the OpenVPN source tree

# A horrid work around, from a security perspective,
# is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have
# been WARNED.
PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin

# init variables

i=1
domains=
fopt=
ndoms=0
nns=0
nl='
'

# $foreign_option_<n> is something like
# "dhcp-option DOMAIN example.com" (multiple allowed)
# or
# "dhcp-option DNS 10.10.10.10" (multiple allowed)

# each DNS option becomes a "nameserver" option in resolv.conf
# if we get one DOMAIN, that becomes "domain" in resolv.conf
# if we get multiple DOMAINS, those become "search" lines in resolv.conf
# if we get no DOMAINS, then don't use either domain or search.

while true; do
  eval fopt=\$foreign_option_${i}
  [ -z "${fopt}" ] && break

  case ${fopt} in
		dhcp-option\ DOMAIN\ *)
           ndoms=$((ndoms + 1))
           domains="${domains} ${fopt#dhcp-option DOMAIN }"
           ;;
		dhcp-option\ DNS\ *)
           nns=$((nns + 1))
           if [ $nns -le 3 ]; then
             dns="${dns}${dns:+$nl}nameserver ${fopt#dhcp-option DNS }"
           else
             printf "%s\n" "Too many nameservers - ignoring after third" >&2
           fi
           ;;
        *)
           printf "%s\n" "Unknown option \"${fopt}\" - ignored" >&2
           ;;
	esac
  i=$((i + 1))
done

ds=""
if [ $ndoms -eq 1 ]; then
  ds="${nl}domain"
elif [ $ndoms -gt 1 ]; then
  ds="${nl}search"
fi

# This is the complete file - "$domains" has a leading space already
out="# resolv.conf autogenerated by ${0} (${1})${nl}${dns}${ds}${domains}"

# use resolvconf if it's available
if type resolvconf >/dev/null 2>&1; then
  printf "%s\n" "${out}" | resolvconf -p -a "${1}"
else
  # Preserve the existing resolv.conf
  if [ -e /etc/resolv.conf ] ; then
    cp /etc/resolv.conf /etc/resolv.conf.ovpnsave
  fi
  printf "%s\n" "${out}" > /etc/resolv.conf
  chmod 644 /etc/resolv.conf
fi

exit 0

Here is the cli I am executing.

sudo openvpn --client --script-security 2 --config /etc/openvpn/client.conf

Here is the output on the connection.

Wed Jul 27 10:44:35 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
Wed Jul 27 10:44:35 2016 library versions: OpenSSL 1.0.2g-fips  1 Mar 2016, LZO 2.08
Enter Auth Username: *******************
Enter Auth Password: **********
Wed Jul 27 10:44:49 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Jul 27 10:44:49 2016 PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-plugin-down-root.so '[/usr/lib/openvpn/openvpn-plugin-down-root.so] [/etc/openvpn/client.down]' intercepted=PLUGIN_UP|PLUGIN_DOWN 
Wed Jul 27 10:44:49 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Jul 27 10:44:49 2016 UDPv4 link local: [undef]
Wed Jul 27 10:44:49 2016 UDPv4 link remote: [AF_INET]209.197.6.142:1194
Wed Jul 27 10:44:49 2016 TLS: Initial packet from [AF_INET]209.197.6.142:1194, sid=44c29e27 2cdf17cd
Wed Jul 27 10:44:49 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Jul 27 10:44:49 2016 VERIFY OK: depth=1, C=US, ST=VPN, L=VPN, O=VPN, OU=VPN, CN=VPN, name=VPN, emailAddress=VPN
Wed Jul 27 10:44:49 2016 Validating certificate key usage
Wed Jul 27 10:44:49 2016 ++ Certificate has key usage  00a0, expects 00a0
Wed Jul 27 10:44:49 2016 VERIFY KU OK
Wed Jul 27 10:44:49 2016 Validating certificate extended key usage
Wed Jul 27 10:44:49 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Jul 27 10:44:49 2016 VERIFY EKU OK
Wed Jul 27 10:44:49 2016 VERIFY OK: depth=0, C=US, ST=VPN, L=VPN, O=VPN, OU=VPN, CN=vpn, name=VPN
Wed Jul 27 10:44:49 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jul 27 10:44:49 2016 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jul 27 10:44:49 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jul 27 10:44:49 2016 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jul 27 10:44:49 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Jul 27 10:44:49 2016 [vpn] Peer Connection Initiated with [AF_INET]209.197.6.142:1194
Wed Jul 27 10:44:51 2016 SENT CONTROL [vpn]: 'PUSH_REQUEST' (status=1)
Wed Jul 27 10:44:51 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 198.18.0.1,dhcp-option DNS 198.18.0.2,rcvbuf 262144,explicit-exit-notify 5,route-gateway 172.21.92.1,topology subnet,ping 20,ping-restart 40,ifconfig 172.21.92.6 255.255.254.0'
Wed Jul 27 10:44:51 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jul 27 10:44:51 2016 OPTIONS IMPORT: explicit notify parm(s) modified
Wed Jul 27 10:44:51 2016 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Wed Jul 27 10:44:51 2016 Socket Buffers: R=[212992->425984] S=[212992->212992]
Wed Jul 27 10:44:51 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jul 27 10:44:51 2016 OPTIONS IMPORT: route options modified
Wed Jul 27 10:44:51 2016 OPTIONS IMPORT: route-related options modified
Wed Jul 27 10:44:51 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Jul 27 10:44:51 2016 ROUTE_GATEWAY 10.0.0.1/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:56:38:d7
Wed Jul 27 10:44:51 2016 TUN/TAP device tun0 opened
Wed Jul 27 10:44:51 2016 TUN/TAP TX queue length set to 100
Wed Jul 27 10:44:51 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jul 27 10:44:51 2016 /sbin/ip link set dev tun0 up mtu 1500
Wed Jul 27 10:44:51 2016 /sbin/ip addr add dev tun0 172.21.92.6/23 broadcast 172.21.93.255
Wed Jul 27 10:44:51 2016 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-down-root.so/PLUGIN_UP status=0
Wed Jul 27 10:44:51 2016 /etc/openvpn/client.up tun0 1500 1570 172.21.92.6 255.255.254.0 init
resolvconf: Error: Command not recognized
Usage: resolvconf (-d IFACE|-a IFACE|-u|--enable-updates|--disable-updates|--updates-are-enabled)
sh: printf: I/O error
Wed Jul 27 10:44:51 2016 /sbin/ip route add 209.197.6.142/32 via 10.0.0.1
Wed Jul 27 10:44:51 2016 /sbin/ip route add 0.0.0.0/1 via 172.21.92.1
Wed Jul 27 10:44:51 2016 /sbin/ip route add 128.0.0.0/1 via 172.21.92.1
Wed Jul 27 10:44:51 2016 Initialization Sequence Completed

Here is the error in the above I think is the probelm.

Wed Jul 27 10:44:51 2016 /etc/openvpn/client.up tun0 1500 1570 172.21.92.6 255.255.254.0 init
resolvconf: Error: Command not recognized
Usage: resolvconf (-d IFACE|-a IFACE|-u|--enable-updates|--disable-updates|--updates-are-enabled)
sh: printf: I/O error

TinCanTech

That is a new script and so may not be fully compatible as it stands.

This may help more:
https://github.com/masterkorp/openvpn-update-resolv-conf

You are going to have to read the supporting docs on that page.

TinCanTech

Openvpn from the official Ubuntu repos ships with update-resolv-conf and should be installed to /etc/openvpn by default.

rushd

The update-resolv-conf worked! Thank you for your help. I wish that was documented better to know to use. At least for a noob like me looking for information.

TinCanTech

Great .. thanks for letting me know 8-)