For an existing CentOS 7-style OpenVPN client where the tunnel should remain but its DNS hooks should stop running. It backs up the selected client config and comments matching hooks. With --set-dns it may change the active NetworkManager profile or overwrite /etc/resolv.conf, depending on the host; it does not provide automatic rollback.
This command downloads the bundled file only; it does not run it. Inspect the saved source and compare its version before deciding whether to execute it.
Compare a saved file with the exact bytes bundled in this page’s build. The file stays in this tab; this tool does not upload or persist it. Maximum 2 MiB.
Save the script and checksum in the same directory. On Linux with GNU Coreutils, the command below checks the saved bytes only; it does not run the script. Keep the original filename for this command.
The checksum and script come from the same site, not an independent signature. A match does not prove safety, authenticity of upstream dependencies, or suitability for your host. Mutable remote dependencies need separate review.
An existing client config at /etc/openvpn/client/client.conf
Best for
Keep the VPN tunnel up but stop it from forcing an internal DNS like 10.7.7.53
Restore your own public resolvers on a host that does not need *.internal name resolution
Undo the DNS hooks added by install_openvpn_client_centos7.sh without reinstalling
Highlights
Backs up client.conf to a timestamped .bak before changing anything
Comments matching script-security / up / down DNS hook lines; a backup is made on every run
Restarts openvpn-client@client so the change takes effect immediately
Optional --set-dns "ns1 ns2" writes /etc/resolv.conf for you
Supports --config-dir / --config-name for non-default install locations
Manual recovery only: restore the saved config or uncomment the hooks, then restart the client service
Recommended procedure
Download and inspect the script first. Confirm the selected config and resolver manager; run only during an authorized maintenance window with root privileges.
The script backs up the config, comments matching DNS hook lines, then attempts to restart the selected OpenVPN client service.
Use --set-dns only after checking whether NetworkManager owns DNS. Without it, the script leaves /etc/resolv.conf unchanged.
Check service state and resolver configuration, then test required internal and public hostnames. A running tunnel alone does not prove DNS is correct.
Safety notes
Internal DNS names may stop resolving after hooks are disabled.
Keep timestamped config backups; rollback is manual.
--set-dns changes NetworkManager or replaces resolv.conf depending on ownership.
Compatibility and limits
Written for CentOS 7 OpenVPN client service conventions; requires root, systemctl, and the configured client file. The default target is /etc/openvpn/client/client.conf and openvpn-client@client; --config-dir and --config-name select alternatives.
There is no dry-run. A timestamped config copy is made, but it is not an automatic rollback. When --set-dns is used, the script may modify the active NetworkManager profile or truncate and rewrite /etc/resolv.conf.
The script does not validate resolver addresses. The optional direct resolv.conf write can conflict with NetworkManager or another resolver manager.
Files, services, and data affected
Comments matching script-security 2, up /etc/openvpn/update-resolv-conf, and down /etc/openvpn/update-resolv-conf lines in the selected client config.
Restarts the selected OpenVPN client service if systemctl recognizes it. A restart failure is ignored before the script checks whether the service is active.
If NetworkManager is active, nmcli exists, and an active profile matches the default-route interface, resets that profile to DHCP DNS or the supplied --set-dns values; otherwise --set-dns overwrites /etc/resolv.conf. Without --set-dns, the script leaves /etc/resolv.conf untouched.
Read-only verification
Before running, inspect the target config and active resolver manager with `sudo grep -nE "^(#?script-security 2|#?up /etc/openvpn/update-resolv-conf|#?down /etc/openvpn/update-resolv-conf)" /etc/openvpn/client/client.conf`, `systemctl status openvpn-client@client`, and `readlink -f /etc/resolv.conf`.
After an approved maintenance run, check `systemctl status openvpn-client@client`, `nmcli connection show --active`, and `cat /etc/resolv.conf`; test both an internal hostname (if required) and a public hostname. Review the generated .bak file and active NetworkManager DNS settings.
If it fails
If DNS or the tunnel fails, keep the generated config backup, inspect `sudo journalctl -u openvpn-client@client -n 100 --no-pager` and `nmcli connection show`, then restore the config hooks manually if appropriate and restart the service. Restore resolver settings through the same manager that owns /etc/resolv.conf; do not blindly overwrite a managed or symlinked file.
Download, inspect, then verify the version before execution. A hash only identifies these exact bytes; it does not prove safety. Piped commands run remote content immediately, and upstream dependencies can change.
