Linux – Allow OpenVPN client to push it’s own DNS servers, regardless of OpenVPN server’s pushed dns

domain-name-systemlinuxlinux-networkingopenvpnvpn

There is an OpenVPN server running on a Debian and it pushes a DNS in the server config file:

push "dhcp-option DNS 8.8.8.8"

Is there an option to allow the users to change that DNS servers on the client side?

Here is the catch, the openvpn server must push a DNS because otherwise many OpenVPN clients will not be able to open web pages until the manually set DNS servers in system's network settings.

My goal is to automatically apply a default DNS server to not-technically-skilled users, while also allow skilled computer users to set their own DNS servers.

Note that simply changing DNS settings on the PC while the 'push "dhcp-option DNS 8.8.8.8"' option is active on the openvpn server, does nothing. The DNS pushed by the server remains regardless of the local DNS settings.

Any ideas?

OpenVPN server config:

# cat /etc/openvpn/openvpn.conf
server 10.186.35.0 255.255.255.0
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
ifconfig-pool-persist ipp.txt
#push "route 0.0.0.0 0.0.0.0"
#push "redirect-gateway"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
user nobody
group users
persist-key
persist-tun
status openvpn-status.log
verb 3
script-security 3
auth-user-pass-verify /etc/openvpn/auth-chap via-env
client-cert-not-required
duplicate-cn
management 127.0.0.1 5119
script-security 3 system
username-as-common-name
client-connect /etc/openvpn/scripts/clientconnect.sh
client-disconnect /etc/openvpn/scripts/clientdisconnect.sh
log-append /var/log/openvpn.log
log /var/log/openvpn.log

UPDATE: The clients operating systems are Windows and Mac

Best Answer

As of 2017 (OpenVPN 2.4) this is now possible. Add this line to your client config file:

pull-filter ignore "dhcp-option DNS"

and it will ignore all pushed config lines that start with the quoted text.

Options are matched top-down, so the first match is used. You can use this to allow some routes and reject others, if it suits your needs.

The three action keywords are accept, ignore, and reject. I have not discovered a use case for reject.