Problem statement
Why can OpenVPN connect but internal domains still fail to resolve?
The tunnel can be up while DNS still fails if the helper script is not executable, was saved with CRLF line endings, or the host is still managed by systemd-resolved instead of a plain resolv.conf file.
The fix is to confirm the hook script can run, normalize line endings, and on Ubuntu verify DNS behavior with resolvectl instead of assuming /etc/resolv.conf tells the full story.
What to check
- Check line endings on update-resolv-conf.
- Confirm the script is executable by OpenVPN.
- Use resolvectl status on Ubuntu to inspect real DNS state.
Parent topic
Set up OpenVPN client access on Ubuntu and CentOS 7 hosts, keep login files in the expected place, and handle DNS switching safely when private domains depend on the tunnel.