I recently installed OpenBSD 5.9 and I'm trying to get it functional enough to use as a replacement for Debian. One thing where I hit a brick wall is connecting to my VPN. I use a commercial VPN which I'm happily using under several Linux distros.The openvpn config file looks like this:clientdev tunproto udpremote germany.vpnprovider.com 1194resolv-retry infinitenobindpersist-keypersist-tunca ca.crttls-clientremote-cert-tls serverauth-user-passcomp-lzoverb 1reneg-sec 0crl-verify crl.pemThis is what I do...# openvpn /etc/openvpn/Germany.ovpnoutput:Mon Apr 25 00:20:35 2016 OpenVPN 2.3.10 x86_64-unknown-openbsd5.9 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Feb 25 2016Mon Apr 25 00:20:35 2016 library versions: LibreSSL 2.3.2, LZO 2.09Enter Auth Username:Enter Auth Password:Mon Apr 25 00:21:02 2016 UDPv4 link local: [undef]Mon Apr 25 00:21:02 2016 UDPv4 link remote: [AF_INET]46.166.190.202:1194Mon Apr 25 00:21:02 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent thisMon Apr 25 00:21:02 2016 [VPN PROVIDER] Peer Connection Initiated with [AF_INET]46.166.190.202:1194Mon Apr 25 00:21:05 2016 TUN/TAP device tun0 exists previously, keep at program endMon Apr 25 00:21:05 2016 TUN/TAP device /dev/tun0 openedMon Apr 25 00:21:05 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0Mon Apr 25 00:21:05 2016 /sbin/ifconfig tun0 10.199.1.6 10.199.1.5 mtu 1500 netmask 255.255.255.255 upadd net 46.166.190.202: gateway 192.168.0.1add net 0.0.0.0: gateway 10.199.1.5add net 128.0.0.0: gateway 10.199.1.5add net 10.199.1.1: gateway 10.199.1.5Mon Apr 25 00:21:05 2016 Initialization Sequence CompletedThe last line seems to indicate that something went right... However, when I want to connect to the internet, I don't get anything. Opening a website in Firefox doesn't work and neither does pinging it.$ ping -c 3 www.google.comThis just hangs (I don't get any output)However, pinging a nameserver does work.$ ping -c 3 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes64 bytes from 8.8.8.8: icmp_seq=0 ttl=46 time=40.946 ms64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=38.382 ms64 bytes from 8.8.8.8: icmp_seq=2 ttl=46 time=39.153 ms--- 8.8.8.8 ping statistics ---3 packets transmitted, 3 packets received, 0.0% packet lossround-trip min/avg/max/std-dev = 38.382/39.494/40.946/1.074 msI've been hunting the internet for answers and found nothing that works. There is very little information on the subject of using commercial VPNs on OpenBSD. It seems to me that there is a problem with getting an IP for my tun0 or something. I have enabled ip.forwarding and ip6.forwarding in /etc/sysctl.conf and tried other things, but to no avail. Linux uses openresolv to update /etc/resolv.conf, but I have no idea how to implement this in OpenBSD...UPDATEAs per request, my /etc/resolv.conf after boot (trunk0 ups iwn0 if not connected to ethernet cable):# Generated by trunk0 dhclientsearch homenameserver 195.130.131.5nameserver 195.130.130.5lookup file bindMy resolv.conf doesn't change after connecting to the VPN... So I checked what resolv.conf looks like in Debian when connected to the VPN and I manually changed /etc/resolv.conf on OpenBSD after connecting to the VPN and lo, addresses get resolved and my IP seems to be in Germany (whatismyipaddress.com). Except for adding two nameservers I got throught the Debian .conf, I didn't change anything in the file.I suppose the problem now is that this doesn't happen automatically. Should I write some script for this or are there better/standardized ways to do this? Am I completely doing it wrong? Where do I go from here?Thanks for the help so far... My networking knowledge is very limited.UPDATE 2 (Solved?)The solution I came up with is the following:As I explained above, I could access the internet once I specified the desired nameservers in /etc/resolv.conf. The problem with this is that dhclient overwrites the contents of this file each time it is run. Putting the nameservers in /etc/resolv.conf.tail doesn't work as this file is sourced after /etc/resolv.conf and the added nameservers aren't chosen first.My solution was to put them in /etc/dhclient.conf e.g.:prepend domain-name-servers 210.232.10.246;prepend ...;This way, these nameservers are tried first and connecting to the VPN works (semi)automatically, as desired.What still bothers me a bit is the fact that I had to specify these nameservers. With NetworkManager on Debian, these nameservers are somehow found and dynamically added when connecting to the VPN. If anyone knows more, please enlighten me. Is there a less hackish solution?Lastly, if no other/better answer comes along, I guess I will add my solution as an Answer...
Connect to commercial VPN on OpenBSD 5.9
dns;openvpn;dhcp;openbsd