amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-15 05:42:07 +00:00

[GH-ISSUE #1396] DNS Resolution Failure OpenRC #571

New issue

Open

opened 2026-10-13 20:24:19 +00:00 by bsakaguchi · 4 comments

bsakaguchi commented

2026-10-13 20:24:19 +00:00

Owner

Originally created by @glad2rest on GitHub (Feb 3, 2025).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1396

When enabling AmneziaVPN using OpenRC, DNS resolution fails for all domain names. This issue prevents any DNS queries from being resolved while the VPN is active. The problem can be temporarily resolved by flushing the amnvpn.a.310.blockDNS chain using the command:

iptables -F amnvpn.a.310.blockDNS

However, this is not a permanent solution and needs to be applied every time the VPN is enabled.

To Reproduce start the AmneziaVPN service using OpenRC:

rc-service amnezia start

Open AmneziaVPN client and press "Connect" button.

Attempt to resolve any domain name, for example:

> curl icanhazip.com
curl: (6) Could not resolve host: icanhazip.com

My openrc service:

#!/sbin/openrc-run

# Copyright 2025 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
# iptables -F amnvpn.a.310.blockDNS 


name="AmneziaVPN daemon"
description="AmneziaVPN Service"
pidfile="/run/amneziavpn-service.pid"
output_log="/var/log/amneziavpn.log"
error_log="/var/log/amneziavpn.log"

depend() { 
  need net
}
start_pre() {
  checkpath --directory --owner root:root --mode 0755 /var/log
  checkpath --file --owner root:root --mode 0644 /var/log/amneziavpn.log
}
start() {
    ebegin "Starting AmneziaVPN Service"
    export LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib
    start-stop-daemon --start --background --make-pidfile --pidfile "$pidfile" --exec /opt/AmneziaVPN/service/AmneziaVPN-service.sh
    eend $?
}
stop() {
    ebegin "Stopping AmneziaVPN Service"
    start-stop-daemon --stop --pidfile "$pidfile"
    pkill -f [A]mneziaVPN-service
    eend $?
}

Expected behavior:
DNS resolution should work correctly when AmneziaVPN is enabled.

Screenshots:

/etc/resolv.conf

Very doubtful workaround is to add a start_post() block that will parse iptables and erase blockDNS record in the infinite loop:

start_post() {
  ebegin "Checking iptables rules"
  {
    while true; do
      if iptables -L -n | grep -Pq 'amnvpn.a.310.blockDNS\s+all'; then
        iptables -F amnvpn.a.310.blockDNS
        break
      fi
      sleep 1
    done
  } &
  eend $?
}

Any suggestions to resolve this issue? Thank you.

Originally created by @glad2rest on GitHub (Feb 3, 2025). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1396 When enabling AmneziaVPN using OpenRC, DNS resolution fails for all domain names. This issue prevents any DNS queries from being resolved while the VPN is active. The problem can be temporarily resolved by flushing the amnvpn.a.310.blockDNS chain using the command: ```bash iptables -F amnvpn.a.310.blockDNS ``` However, this is not a permanent solution and needs to be applied every time the VPN is enabled. To Reproduce start the AmneziaVPN service using OpenRC: ```bash rc-service amnezia start ``` Open AmneziaVPN client and press "Connect" button. Attempt to resolve any domain name, for example: ```bash > curl icanhazip.com curl: (6) Could not resolve host: icanhazip.com ``` My openrc service: ```bash #!/sbin/openrc-run # Copyright 2025 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 # iptables -F amnvpn.a.310.blockDNS name="AmneziaVPN daemon" description="AmneziaVPN Service" pidfile="/run/amneziavpn-service.pid" output_log="/var/log/amneziavpn.log" error_log="/var/log/amneziavpn.log" depend() { need net } start_pre() { checkpath --directory --owner root:root --mode 0755 /var/log checkpath --file --owner root:root --mode 0644 /var/log/amneziavpn.log } start() { ebegin "Starting AmneziaVPN Service" export LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib start-stop-daemon --start --background --make-pidfile --pidfile "$pidfile" --exec /opt/AmneziaVPN/service/AmneziaVPN-service.sh eend $? } stop() { ebegin "Stopping AmneziaVPN Service" start-stop-daemon --stop --pidfile "$pidfile" pkill -f [A]mneziaVPN-service eend $? } ``` Expected behavior: DNS resolution should work correctly when AmneziaVPN is enabled. Screenshots: - /etc/resolv.conf ![resolv](https://i.ibb.co/r2fQ65c7/resolv-conf.png) Very doubtful workaround is to add a start_post() block that will parse iptables and erase blockDNS record in the infinite loop: ```bash start_post() { ebegin "Checking iptables rules" { while true; do if iptables -L -n | grep -Pq 'amnvpn.a.310.blockDNS\s+all'; then iptables -F amnvpn.a.310.blockDNS break fi sleep 1 done } & eend $? } ``` Any suggestions to resolve this issue? Thank you.

bsakaguchi commented

2026-10-13 20:24:19 +00:00

Author

Owner

@NatOwlley commented on GitHub (Feb 14, 2025):

Same on Arch Linux
Linux 6.13.2-arch1-1 x86_64
AmneziaVPN version 4.8.3.1 956dd6e
Thanks for the workaround, it worked when I deleted amnvpn.a.310.blockDNS

@NatOwlley commented on GitHub (Feb 14, 2025): Same on Arch Linux Linux 6.13.2-arch1-1 x86_64 AmneziaVPN version 4.8.3.1 956dd6e Thanks for the workaround, it worked when I deleted `amnvpn.a.310.blockDNS`

bsakaguchi commented

2026-10-13 20:24:20 +00:00

Author

Owner

@Flashwalker commented on GitHub (Jul 3, 2025):

I have all the dependencies installed, but amnezia just can't resolve the names.

Ubuntu 24.04 / systemd

...
jul 04 00:03:14 AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error retrieving the DNS  domains from the DBus service"
jul 04 00:03:14 AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error received from the DBus service"
jul 04 00:03:14 AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error received from the DBus service"
...

DETAILS

$ systemctl status AmneziaVPN.service
● AmneziaVPN.service - AmneziaVPN Service
     Loaded: loaded (/etc/systemd/system/AmneziaVPN.service; enabled; preset: enabled)
     Active: active (running) since Thu 2025-07-03 22:39:51 +07; 1h 23min ago
   Main PID: 25296 (AmneziaVPN-serv)
      Tasks: 20 (limit: 37621)
     Memory: 31.3M (peak: 34.5M)
        CPU: 9.708s
     CGroup: /system.slice/AmneziaVPN.service
             ├─25296 /bin/sh /opt/AmneziaVPN/service/AmneziaVPN-service.sh
             ├─25299 /opt/AmneziaVPN/service/bin/AmneziaVPN-service
             └─43548 /opt/AmneziaVPN/service/bin/../../client/bin/wireguard-go -f amn0

jul 04 00:03:13 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Adding route to 3.0.0.0/9"
jul 04 00:03:13 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Adding route to 3.128.0.0/9"
jul 04 00:03:13 redtop AmneziaVPN-service.sh[25299]: Amnezia "Daemon" "Connection status: 1"
jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "Daemon" "Checking for handshake..."
jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "Daemon" "awaiting xfxg2zZZCgB7j+xh6RIdWtenIX2lDG5wQ9IsG6k9u0U="
jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Restarting systemd-resolved.service
jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Flush dns completed
jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error retrieving the DNS  domains from the DBus service"
jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error received from the DBus service"
jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error received from the DBus service"

$ systemctl status AmneziaVPN.service
● AmneziaVPN.service - AmneziaVPN Service
     Loaded: loaded (/etc/systemd/system/AmneziaVPN.service; enabled; preset: enabled)
     Active: active (running) since Thu 2025-07-03 22:39:51 +07; 1h 19min ago
   Main PID: 25296 (AmneziaVPN-serv)
      Tasks: 3 (limit: 37621)
     Memory: 4.1M (peak: 34.5M)
        CPU: 7.733s
     CGroup: /system.slice/AmneziaVPN.service
             ├─25296 /bin/sh /opt/AmneziaVPN/service/AmneziaVPN-service.sh
             └─25299 /opt/AmneziaVPN/service/bin/AmneziaVPN-service

jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Removing exclusion route for /999999"
jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Invalid destination prefix"
jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Removing exclusion route for 89.105.216.101/32"
jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Gateway  192.168.0.1  for interface  wlp0s20f3
jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "WireguardUtilsLinux destroyed."
jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxFirewall" "Tearing down cgroup and routing rules"
jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxFirewall" "( 255 ) $  ip route flush table amnvpnrt"
jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxFirewall" "Error: argument \"amnvpnrt\" is wrong: table id value is invalid"
jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxFirewall" "LinuxFirewall::uninstall() complete"
jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "DaemonLocalServerConnection" "Connection released"

@Flashwalker commented on GitHub (Jul 3, 2025): I have all the dependencies installed, but amnezia just can't resolve the names. Ubuntu 24.04 / systemd ``` ... jul 04 00:03:14 AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error retrieving the DNS domains from the DBus service" jul 04 00:03:14 AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error received from the DBus service" jul 04 00:03:14 AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error received from the DBus service" ... ``` <details><summary>DETAILS</summary> <p> ``` $ systemctl status AmneziaVPN.service ● AmneziaVPN.service - AmneziaVPN Service Loaded: loaded (/etc/systemd/system/AmneziaVPN.service; enabled; preset: enabled) Active: active (running) since Thu 2025-07-03 22:39:51 +07; 1h 23min ago Main PID: 25296 (AmneziaVPN-serv) Tasks: 20 (limit: 37621) Memory: 31.3M (peak: 34.5M) CPU: 9.708s CGroup: /system.slice/AmneziaVPN.service ├─25296 /bin/sh /opt/AmneziaVPN/service/AmneziaVPN-service.sh ├─25299 /opt/AmneziaVPN/service/bin/AmneziaVPN-service └─43548 /opt/AmneziaVPN/service/bin/../../client/bin/wireguard-go -f amn0 jul 04 00:03:13 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Adding route to 3.0.0.0/9" jul 04 00:03:13 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Adding route to 3.128.0.0/9" jul 04 00:03:13 redtop AmneziaVPN-service.sh[25299]: Amnezia "Daemon" "Connection status: 1" jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "Daemon" "Checking for handshake..." jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "Daemon" "awaiting xfxg2zZZCgB7j+xh6RIdWtenIX2lDG5wQ9IsG6k9u0U=" jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Restarting systemd-resolved.service jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Flush dns completed jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error retrieving the DNS domains from the DBus service" jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error received from the DBus service" jul 04 00:03:14 redtop AmneziaVPN-service.sh[25299]: Amnezia "DnsUtilsLinux" "Error received from the DBus service" ``` ``` $ systemctl status AmneziaVPN.service ● AmneziaVPN.service - AmneziaVPN Service Loaded: loaded (/etc/systemd/system/AmneziaVPN.service; enabled; preset: enabled) Active: active (running) since Thu 2025-07-03 22:39:51 +07; 1h 19min ago Main PID: 25296 (AmneziaVPN-serv) Tasks: 3 (limit: 37621) Memory: 4.1M (peak: 34.5M) CPU: 7.733s CGroup: /system.slice/AmneziaVPN.service ├─25296 /bin/sh /opt/AmneziaVPN/service/AmneziaVPN-service.sh └─25299 /opt/AmneziaVPN/service/bin/AmneziaVPN-service jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Removing exclusion route for /999999" jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Invalid destination prefix" jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "Removing exclusion route for 89.105.216.101/32" jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Gateway 192.168.0.1 for interface wlp0s20f3 jul 03 23:54:58 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxRouteMonitor" "WireguardUtilsLinux destroyed." jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxFirewall" "Tearing down cgroup and routing rules" jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxFirewall" "( 255 ) $ ip route flush table amnvpnrt" jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxFirewall" "Error: argument \"amnvpnrt\" is wrong: table id value is invalid" jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "LinuxFirewall" "LinuxFirewall::uninstall() complete" jul 03 23:55:02 redtop AmneziaVPN-service.sh[25299]: Amnezia "DaemonLocalServerConnection" "Connection released" ``` ![Image](https://github.com/user-attachments/assets/210e65fc-2cc8-4455-9974-0287447062bd) </p> </details>

bsakaguchi commented

2026-10-13 20:24:20 +00:00

Author

Owner

@Inevitabilis commented on GitHub (Aug 4, 2026):

to all that find troubles with DNS resolving on amnezia on linux:
you can check status of looking up any address via dig site.com
the thing that amnezia likely uses on your setup is likely iptables. it is for me at least
you can see what's inside via sudo iptables -L
there in OUTPUT chain it references chain amnvpn.anchors which goes through chain amnvpn.a.320.allowDNS and then amnvpn.a.310.blockDNS (so, whitelist before blacklist)
amnvpn.a.320.allowDNS references amnvpn.320.allowDNS which lists two addresses inside, most notably 8.8.4.4, the other one i suppose is the used vps
so basically for dns to work in vpn one would need to set either of those as default DNS servers. you can do it via /etc/resolv.conf (note: it's usually managed by other program so sometimes the file resets to pre-edit states)
add nameserver 8.8.4.4 (or the other one) at the top to use that ip as default and do sudo systemctl restart NetworkManager and amnezia should figure out DNS resolving

@Inevitabilis commented on GitHub (Aug 4, 2026): to all that find troubles with DNS resolving on amnezia on linux: you can check status of looking up any address via `dig site.com` the thing that amnezia likely uses on your setup is likely iptables. it is for me at least you can see what's inside via `sudo iptables -L` there in `OUTPUT` chain it references chain `amnvpn.anchors` which goes through chain `amnvpn.a.320.allowDNS` and then `amnvpn.a.310.blockDNS` (so, whitelist before blacklist) `amnvpn.a.320.allowDNS` references `amnvpn.320.allowDNS` which lists two addresses inside, most notably 8.8.4.4, the other one i suppose is the used vps so basically for dns to work in vpn one would need to set either of those as default DNS servers. you can do it via `/etc/resolv.conf` (note: it's usually managed by other program so sometimes the file resets to pre-edit states) add `nameserver 8.8.4.4` (or the other one) at the top to use that ip as default and do `sudo systemctl restart NetworkManager` and amnezia should figure out DNS resolving

bsakaguchi commented

2026-10-13 20:24:21 +00:00

Author

Owner

@lerothias commented on GitHub (Aug 14, 2026):

Can confirm this is still happening on 5.0.0.5 with a manual OpenRC service. The iptables -F amnvpn.a.310.blockDNS workaround still works but has to be reapplied after every connect. It would be great if the client could detect the absence of systemd-resolved and manage resolv.conf/openresolv directly.

@lerothias commented on GitHub (Aug 14, 2026): Can confirm this is still happening on 5.0.0.5 with a manual OpenRC service. The `iptables -F amnvpn.a.310.blockDNS` workaround still works but has to be reapplied after every connect. It would be great if the client could detect the absence of systemd-resolved and manage resolv.conf/openresolv directly.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#571

No description provided.

Rows
Columns