[wruza]

Has nothing to do with VPN or OpenVPN (almost). “You can’t trust” “Linux” in this case. Its network stack is still not mouse-friendly in general and requires some thought.

Quoting key points from TFA:

- (DNS leak happens)

- The DNS changes are not automatically applied by the OpenVPN client on Linux.

- You need to configure up and down scripts for managing the DNS updates.

- The recommended script is update-resolv-conf, which modifies DNS settings when the VPN connects and restores them upon disconnection.

- That script consists of a bunch of arcane bash commands that I don't understand.

Iow, OpenVPN decided to not mess with system scripting.

For Linux, the OpenVPN client can receive DNS host information from the server, but the client expects an external command to act on this information. No such commands are configured by default. They must be specified with the up and down options. There are a few alternatives for what scripts to use, but none are officially recognised by OpenVPN, so in order for any of them to work, script-security must be set to 2. The down-root plugin can be used instead of the down option if running as an unprivileged user.

Otoh, it could at least signal that somehow in the ui/cli. Does it not? I’m pretty sure there’s no dns leaks on my kubuntu boxes with ovpn profiles, but can’t test right now. If so, it’s probably an even narrower Arch + network manager problem.

[vetinari]

This is something I always wondered about: why so many linux users always take the hard way?

They have two options: a) use the mouse-friendly way in NetworkManager to configure their VPN client (yes, it handles VPN DNS too; if you have systemd-resolved, it can also do split-horizon DNS over specific links) or b) funble around with tools and scripts they have no idea how they work, complain how complicated it is, and either get lucky so it works somehow or break their system entirely.

With a current desktop linux system, they should take the option a). They can use command line if they insist, nmcli is also here.

[godelski]

The mouse is the hard way.

OP could have solved their problem by rtfming... It is literally the first paragraph on DNS. We're talking about "turn it off and on again" style issues.

Before you reach for GPT, check the man pages and check the Arch wiki, you'll save a lot of time and get more information.

https://wiki.archlinux.org/title/OpenVPN#DNS

[vetinari]

We probably have different ideas about what constitutes the hard way; but that's not the point in this thread.

Anyway, NetworkManager can be managed using cli for those that insist, so all that was needed was:

    nmcli connection import type openvpn file <filename.ovpn>

Even Arch wiki says:

> By default networkmanager-openvpn plugin appends DNS servers provided by OpenVPN to /etc/resolv.conf.

(which is not really true. Yes, it does the right thing with DNS info, but the specific action depends on the resolver backend NetworkManager is configured to use; for systemd-resolved and dnsmasq it configures these services instead).

[godelski]

I saw the cli is the easy way because it lets you do more. The barrier to entry is higher, yes, but if you're willing to get through that, things become easier. And by easier I mean take less time and get better results as well as easier to find solutions[0].

  > Arch wiki

It looks like their solution was following the config in 9.3. So this is why I made a snipe at reaching for GPT when the Wiki is there.

[0] The analogy I'll give is that often a novice works harder than an expert when doing the same task, even if the task is simple. This is often because the expert is doing very minute things that they might not even notice that they can leverage. I know coders rock climb, so I'll use that as an example: this may be something like a subtle finger placement or how center of gravity is placed. The practiced person has more strength, but they will literally use less energy to get up a wall than a novice (and then it can be easy to overestimate what a novice can do because they judge what energy they use)

[wruza]

I think I did exactly that on my servers and had no dns issues. Just dropped an .ovpn into it.