OpenVPN: DNS and dnsmasq configuration
Tags: networking, openvpn, dns, aws
Published: 2019-03-23 09:53:03

---
title: OpenVPN: DNS and dnsmasq configuration
published: true
tags: Networking,OpenVPN,DNS,AWS
canonical_url: https://rtfm.co.ua/en/openvpn-dns-and-dnsmasq-configuration/
---

![](https://rtfm.co.ua/wp-content/uploads/2014/07/openvpn-logo-1.png)In addition to the [OpenVPN: OpenVPN Access Server set up and AWS VPC peering configuration](https://rtfm.co.ua/en/openvpn-openvpn-access-server-set-up-and-aws-vpc-peering-configuration/ "OpenVPN: OpenVPN Access Server set up and AWS VPC peering configuration") post – DNS settings example.

We have the _ci.example.com_ domain, which has to be resolved to its Public IP (of the AWS EC2 instance) if it’s requested from thу Internet – or to its Private IP – if requested via a VPN connection.

To achieve this – you can use the `dnsmasq` service installed on the OpenVPN AS host.

Install it:

```
$ sudo apt -y install dnsmasq
```

Create a `/etc/dnsmasq.hosts` file with hardcoded Private IPs for necessary services:

```
10.0.5.10 ci.example.com 
172.31.36.107 nexus-repo.example.com 
10.0.3.105 rabbitadmin-production.example.com 
10.0.1.6 monitor.example.com
```

Next – update `/etc/dnsmasq.conf` file and add the [`addn-hosts`](http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html) option so it will look  like next:

```
listen-address=127.0.0.1
listen-address=10.0.10.4
bind-interfaces
log-queries
addn-hosts=/etc/dnsmasq.hosts
```

Restart the `dnsmasq` service:

```
root@openvpnas2:~# service dnsmasq restart
```

Check locally:

```
root@openvpnas2:~# dig @localhost ci.example.com +short
10.0.5.10
```

Good.

Now go to your OpenVPN’s admin page => _VPN Settings_ and set the _Have clients use specific DNS servers_ to _Yes_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190222_165429.png "OpenVPN: настройки DNS и dnsmasq")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190222_165429.png)

In the _Primary DNS Server_ field set your EC2’s Private IP where is your OpenVPN server running.

Restart your VPN connection on a workstation:

```
$ sudo openvpn --config vpnroot-client.ovpn
...
Fri Feb 22 16:53:58 2019 /usr/bin/ip link set dev tun0 up mtu 1500
Fri Feb 22 16:53:58 2019 /usr/bin/ip addr add dev tun0 172.27.240.25/20 broadcast 172.27.255.255
Fri Feb 22 16:53:58 2019 /etc/openvpn/update-resolv-conf tun0 1500 1553 172.27.240.25 255.255.240.0 init
dhcp-option DNS 10.0.10.4
...
```

Check local `resolv.conf`:

```
$ cat /etc/resolv.conf
# Generated by resolvconf
nameserver 10.0.10.4
```

Check DNS resolution:

```
$ dig ci.example.com +short
10.0.5.10
```

And any other:

```
$ dig google.com +short
74.125.193.100
74.125.193.101
74.125.193.102
```

Done.

UPD: But there is much more correct solution using [DNS resolution via AWS Peerings](https://docs.aws.amazon.com/en_us/vpc/latest/peering/modify-peering-connections.html#vpc-peering-dns).

### Similar posts

- <small>02/21/2019</small> [OpenVPN: OpenVPN Access Server set up and AWS VPC peering configuration](https://dev.to/setevoy2/openvpn-openvpn-access-server-set-up-and-aws-vpc-peering-configuration-66b-temp-slug-8374150)<small> (0)</small>  
- <small>03/02/2019</small> [Arch Linux: OpenVPN – resolv.conf is not updated](https://rtfm.co.ua/en/arch-linux-openvpn-resolv-conf-not-updated/)<small> (0)</small>  
- <small>02/22/2019</small> [OpenVPN: настройки DNS и dnsmasq](https://rtfm.co.ua/openvpn-nastrojki-dns-i-dnsmasq/)<small> (0)</small>  
- <small>02/21/2019</small> [OpenVPN: настройка OpenVPN Access Server и AWS VPC peering](https://rtfm.co.ua/openvpn-nastrojka-openvpn-access-server-i-aws-vpc-peering/)<small> (0)</small>  
- <small>03/02/2019</small> [Arch Linux: OpenVPN – не обновляется resolv.conf](https://rtfm.co.ua/arch-linux-openvpn-ne-obnovlyaetsya-resolv-conf/)<small> (0)</small>