Flash Sale:75% Off Hosting + Free DomainEnds in13h47m14sView Plans
Hostvento logoHostvento
Get Started

Fix a DNS Leak with OpenVPN on Ubuntu

Make sure DNS requests go through the VPN and not through your normal internet connection.

VPS and Cloud Servers2 min read10 steps5 screenshots

What a DNS leak is

OpenVPN encrypts your traffic, but your computer may still send DNS requests (the lookups of site names) to your ISP's DNS server. That is a DNS leak. It shows the sites you visit.

Common causes on Ubuntu:

  1. OpenVPN is not set up to use the DNS servers of the VPN.
  2. systemd-resolved and OpenVPN clash.
  3. NetworkManager overrides the DNS settings.

Detect a leak

Online: connect to the VPN and open a DNS leak test website. If it shows your own ISP, you have a leak.

A DNS leak test

Command line:

resolvectl status
The DNS status on Ubuntu

While the VPN is connected, the VPN interface (for example tun0) should list the VPN DNS servers.

Method 1: Use an update-resolv-conf script

  1. Download the script:
sudo wget -O /etc/openvpn/update-resolv-conf https://raw.githubusercontent.com/masterkorp/openvpn-update-resolv-conf/master/update-resolv-conf.sh
Downloading the script
  1. Make it executable:
sudo chmod +x /etc/openvpn/update-resolv-conf
  1. Add these lines to your .ovpn client file:
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
The lines in the ovpn file
  1. Restart OpenVPN:
sudo systemctl restart openvpn@client
Note: The openvpn package of Ubuntu already includes a script at this path on many releases. Check with ls /etc/openvpn/update-resolv-conf and download only if it is missing. Download scripts only from a source you trust.

Method 2: Use systemd-resolved

  1. Install the helper package:
sudo apt install openvpn-systemd-resolved
Installing openvpn-systemd-resolved
  1. Add these lines to the client file:
script-security 2
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
  1. Restart OpenVPN:
sudo systemctl restart openvpn@client

Method 3: Block outside DNS (Windows clients)

For Windows clients, add this line:

block-outside-dns

More tips

  • Use a VPN client that has DNS leak protection built in.
  • Try another VPN server or protocol if the leak stays.
  • Keep your system and VPN software updated.

Quick recap

  • Test for leaks with resolvectl status and a DNS leak test site.
  • Use update-resolv-conf or update-systemd-resolved in your client file.
  • Restart OpenVPN and test again.