search

slingamn / namespaced-openvpn

Wrapper for OpenVPN on Linux solving various privacy issues
MIT License
320 stars 45 forks source link

Namespace DNS resolver is pushed to the global resolver configuration #11

Closed Asuranceturix closed 5 years ago

Asuranceturix commented 5 years ago

I seem to be experiencing the oppposite as the issue #7 . In my case, when the VPN is not active, the contents of /etc/resolv.conf are:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "systemd-resolve --status" to see details about the actual nameservers.

nameserver 127.0.0.53

However, whenever I start the VPN (namespaced-openvpn --namespace vpn --writepid foo.pid --log bar.log --daemon --config foobar.ovpn --daemon), the server pushes its DNS server and somehow it ends up prepended to /etc/resolv.conf:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "systemd-resolve --status" to see details about the actual nameservers.

nameserver 1.2.3.4
nameserver 127.0.0.53

The line nameserver 1.2.3.4 is the only contents of /etc/netns/vpn/resolv.conf. When I kill the OpenVPN process, /etc/resolv.conf reverts to its original contents. What am I doing wrong?

slingamn commented 5 years ago

Interesting. Are you running NetworkManager? This is possibly a bad interaction with NetworkManager's openvpn integration. Here's a precedent: https://bugzilla.redhat.com/show_bug.cgi?id=1172012

There are several possible resolutions to this issue, some involving code changes to namespaced-openvpn. (Others might involve reconfiguring or removing one of these packages: NetworkManager, NetworkManager-openvpn, or resolvconf.) I'm interested in getting more information about your setup:

# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "systemd-resolve --status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53

I am currently recommending (in the "DNS hardening" section of the README) that people not use resolvconf(8), for related but distinct reasons. And it seems possible that removing or disabling resolvconf will fix your problem. However, systemd-resolved also has issues. And the typical user may not be able to do without some means of automatically updating /etc/resolv.conf in the root namespace.

Asuranceturix commented 5 years ago

The machine runs Ubuntu 18.04 (no NetworkManager or friends) and resolvconf was still lingering from the previous version before the upgrade (16.04). As you point out, they seem to interact badly, because I have removed resolvconf and now it looks that it works as expected.

Thanks for the suggestions and sorry for the troubles.

slingamn commented 5 years ago

No worries! Reports like this are very useful.

You might want to take a look at the "DNS hardening" section of the README to see if the cautions about systemd-resolved apply to you.