amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-15 05:42:07 +00:00

[GH-ISSUE #1901] Kill Switch on Ubuntu Causes Network Configuration Failure (`Current Scopes: none`) #819

New issue

Open

opened 2026-10-13 20:29:08 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-13 20:29:08 +00:00

Owner

Originally created by @beliaev-maksim on GitHub (Oct 1, 2025).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1901

Summary

When the Kill Switch is enabled on the Linux client (Ubuntu), it prevents the VPN network interface (amn0) from being correctly configured by the system's systemd-resolved service. This results in a complete loss of internet connectivity because the system has no DNS servers assigned to the active interface. The issue is not just a firewall block but a fundamental network configuration failure.

Environment

Operating System: Ubuntu 24.04 LTS
Amnezia Client Version: 4.8.10

Steps to Reproduce

Start with the Kill Switch disabled in the Amnezia client.
Connect to a VPN server. Internet works correctly.
Run resolvectl status in the terminal. Observe that the amn0 interface has Current Scopes: DNS and lists the correct DNS servers.
Disconnect from the VPN.
Enable the Kill Switch.
Connect to the same VPN server.
Attempt to access any website or run ping github.com. The request fails.
Run resolvectl status again. Observe that the amn0 interface now shows Current Scopes: none and has no DNS servers listed.

Expected Behavior

When the Kill Switch is enabled, the VPN should connect, and the amn0 network interface should be correctly configured with a DNS scope and DNS servers, allowing for secure internet access.

Actual Behavior

When the Kill Switch is enabled, the amn0 network interface fails to be configured correctly by the system. resolvectl status shows Current Scopes: none for the interface, leading to a total loss of DNS resolution and internet connectivity.

Diagnostic Logs

1. resolvectl status with Kill Switch OFF (Working State)

Link 17 (amn0)
    Current Scopes: DNS
          Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS
                   DNSSEC=no/unsupported
 Current DNS Server: 1.0.0.1
         DNS Servers: 1.1.1.1 1.0.0.1
          DNS Domain: ~.

2. resolvectl status with Kill Switch ON (Broken State)

Link 18 (amn0)
    Current Scopes: none
          Protocols: -DefaultRoute -LLMNR -mDNS -DNSOverTLS
                   DNSSEC=no/unsupported

Workaround

The only current workaround is to disable the Kill Switch feature. With the Kill Switch off, the VPN connection works as expected.

Originally created by @beliaev-maksim on GitHub (Oct 1, 2025). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1901 #### **Summary** When the **Kill Switch** is enabled on the Linux client (Ubuntu), it prevents the VPN network interface (`amn0`) from being correctly configured by the system's `systemd-resolved` service. This results in a complete loss of internet connectivity because the system has no DNS servers assigned to the active interface. The issue is not just a firewall block but a fundamental network configuration failure. #### **Environment** * **Operating System:** Ubuntu `24.04 LTS` * **Amnezia Client Version:** `4.8.10` ----- #### **Steps to Reproduce** 1. Start with the **Kill Switch disabled** in the Amnezia client. 2. Connect to a VPN server. Internet works correctly. 3. Run `resolvectl status` in the terminal. Observe that the `amn0` interface has `Current Scopes: DNS` and lists the correct DNS servers. 4. Disconnect from the VPN. 5. **Enable the Kill Switch**. 6. Connect to the same VPN server. 7. Attempt to access any website or run `ping github.com`. The request fails. 8. Run `resolvectl status` again. Observe that the `amn0` interface now shows `Current Scopes: none` and has no DNS servers listed. #### **Expected Behavior** When the Kill Switch is enabled, the VPN should connect, and the `amn0` network interface should be correctly configured with a DNS scope and DNS servers, allowing for secure internet access. #### **Actual Behavior** When the Kill Switch is enabled, the `amn0` network interface fails to be configured correctly by the system. `resolvectl status` shows `Current Scopes: none` for the interface, leading to a total loss of DNS resolution and internet connectivity. #### **Diagnostic Logs** **1. `resolvectl status` with Kill Switch OFF (Working State)** ``` Link 17 (amn0) Current Scopes: DNS Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported Current DNS Server: 1.0.0.1 DNS Servers: 1.1.1.1 1.0.0.1 DNS Domain: ~. ``` **2. `resolvectl status` with Kill Switch ON (Broken State)** ``` Link 18 (amn0) Current Scopes: none Protocols: -DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported ``` ----- #### **Workaround** The only current workaround is to disable the Kill Switch feature. With the Kill Switch off, the VPN connection works as expected.

bsakaguchi commented

2026-10-13 20:29:09 +00:00

Author

Owner

@qdzzzxc commented on GitHub (Sep 18, 2026):

I can reproduce this issue on Ubuntu 24.04.3 LTS with AmneziaVPN 5.0.1.5.

In my case, enabling Kill Switch causes an additional severe problem: systemd-resolved enters a busy loop and consumes 100% of one CPU core.

Environment:

Ubuntu 24.04.3 LTS
Kernel: 6.17.0-14-generic
AmneziaVPN: 5.0.1.5
systemd: 255.4-1ubuntu8.17

With Kill Switch enabled, systemd-resolved consumes 100% of one CPU core and resolvectl may become unresponsive:

Failed to get global data: Connection timed out

Restarting or killing/starting systemd-resolved does not fix the CPU usage while the VPN with Kill Switch is active.

strace shows an infinite busy loop like this:

epoll_wait(4, [
  {events=EPOLLERR, ...},
  {events=EPOLLIN, ...}
], 42, -1) = 2

timerfd_settime(
  10,
  TFD_TIMER_ABSTIME,
  {
    it_interval={tv_sec=0, tv_nsec=0},
    it_value={tv_sec=0, tv_nsec=1}
  },
  NULL
) = 0

These two calls repeat continuously at very high speed.

Disabling Kill Switch immediately fixes the problem.

With Kill Switch disabled, amn0 is configured correctly:

Link 5 (amn0)
    Current Scopes: DNS
         Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 1.1.1.1
       DNS Servers: 1.1.1.1 1.0.0.1
        DNS Domain: ~.

systemd-resolved CPU usage then returns to normal.

So it looks like the network/DNS state created by AmneziaVPN's Kill Switch triggers a busy loop in systemd-resolved.

I also tested updating systemd from 255.4-1ubuntu8.12 to 255.4-1ubuntu8.17 and rebooting the machine. The issue still occurs.

Reproduction:

Start AmneziaVPN with Kill Switch disabled.
Connect to VPN — everything works normally.
Enable Kill Switch / reconnect with Kill Switch enabled.
systemd-resolved starts consuming 100% of one CPU core.
Disable Kill Switch and reconnect.
CPU usage returns to normal and amn0 gets the correct DNS scope.

@qdzzzxc commented on GitHub (Sep 18, 2026): I can reproduce this issue on Ubuntu 24.04.3 LTS with AmneziaVPN 5.0.1.5. In my case, enabling Kill Switch causes an additional severe problem: `systemd-resolved` enters a busy loop and consumes 100% of one CPU core. Environment: * Ubuntu 24.04.3 LTS * Kernel: 6.17.0-14-generic * AmneziaVPN: 5.0.1.5 * systemd: 255.4-1ubuntu8.17 With Kill Switch enabled, `systemd-resolved` consumes 100% of one CPU core and `resolvectl` may become unresponsive: `Failed to get global data: Connection timed out` Restarting or killing/starting `systemd-resolved` does not fix the CPU usage while the VPN with Kill Switch is active. `strace` shows an infinite busy loop like this: ``` epoll_wait(4, [ {events=EPOLLERR, ...}, {events=EPOLLIN, ...} ], 42, -1) = 2 timerfd_settime( 10, TFD_TIMER_ABSTIME, { it_interval={tv_sec=0, tv_nsec=0}, it_value={tv_sec=0, tv_nsec=1} }, NULL ) = 0 ``` These two calls repeat continuously at very high speed. Disabling Kill Switch immediately fixes the problem. With Kill Switch disabled, `amn0` is configured correctly: ``` Link 5 (amn0) Current Scopes: DNS Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported Current DNS Server: 1.1.1.1 DNS Servers: 1.1.1.1 1.0.0.1 DNS Domain: ~. ``` `systemd-resolved` CPU usage then returns to normal. So it looks like the network/DNS state created by AmneziaVPN's Kill Switch triggers a busy loop in `systemd-resolved`. I also tested updating systemd from `255.4-1ubuntu8.12` to `255.4-1ubuntu8.17` and rebooting the machine. The issue still occurs. Reproduction: 1. Start AmneziaVPN with Kill Switch disabled. 2. Connect to VPN — everything works normally. 3. Enable Kill Switch / reconnect with Kill Switch enabled. 4. `systemd-resolved` starts consuming 100% of one CPU core. 5. Disable Kill Switch and reconnect. 6. CPU usage returns to normal and `amn0` gets the correct DNS scope.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#819

No description provided.

Rows
Columns

[GH-ISSUE #1901] Kill Switch on Ubuntu Causes Network Configuration Failure (Current Scopes: none) #819