Here is a solution that seems to work for me. Note that I use a simple openvpn client configuration file that I run directly from the console. I don't use a GUI for my vpn connection, but I assume you can do the same via a gui interface.
Within my openvpn client config file, I call a script called update- systemd-resolved as a replacement to the standard update-resolv-conf used previously. That script is available here: https://github.com/jonathanio/update- systemd-resolved After that, after connecting, when I run systemd-resolve --status I can see that a new link is added for tun0 with the proper dns entries. But that's only a first step, because it seems that with systemd.resolved.service (I quote) "Multi-label names are routed to all local interfaces that have a DNS sever configured (...) If lookups are routed to multiple interfaces, the first successful response is returned". So basically it's still sending requests on all interfaces, including the main eth0 or whatever it is on your system, and the fastest one wins (in my case because eth0 points to my router that acts as a dns server, it always wins). To avoid leaks, we want only requests to go to the tun0 link. Then I read that "Routing of lookups may be influenced by configuring per-interface domain names". If you read the instructions in the update-systemd-resolved, you'll see that it allows to specify dhcp- options DOMAIN-ROUTE to force a specific domain to go through that interface. You can use a single dot to mean all domains. So basically I added dhcp-option DOMAIN-ROUTE . to my clienf config to send everything exclusively to tun0 and that seems to do the trick. So combined with the instructions from the github page, this is what I have on my config: # avoid dns leak when using systemd-resolved dhcp-option DOMAIN-ROUTE . script-security 2 setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin up /etc/openvpn/update-systemd-resolved down /etc/openvpn/update-systemd-resolved down-pre -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1624317 Title: systemd-resolved breaks VPN with split-horizon DNS To manage notifications about this bug go to: https://bugs.launchpad.net/systemd/+bug/1624317/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
