Feature #6847

Register CN of OpenVPN clients in DNS Resolver

Added by Lorenz Schori over 4 years ago. Updated over 3 years ago.

DNS Resolver
Target version:
Start date:
Due date:
% Done:


Estimated time:
Plus Target Version:
Release Notes:


Use case: Serial port servers deployed in the field connect to the office via OpenVPN. In order to collect the data, a machine connects to each serial port server via proprietary protocols over the VPN.

Configuring fixed IP addresses for each OpenVPN client is cumbersome and error prone. Instead it would be great if the VPN server would register the common name (CN) of connected clients in the DNS Resolver.

This is currently possible using a learn-address script in OpenVPN as described in this ml-post

I'm using the following learn-address script (/usr/local/sbin/

# openvpn learn-address script maintaining DNS entries of connected clients in
# unbound config.


case "$1" in

      # Remove all configs which mention the CN
      grep -l -null -F "$CN.$DOMAIN" /var/unbound/openvpn.client.*.conf | xargs -0 rm
      rm -f /var/unbound/openvpn.client.$IP.conf

      # Add new local-data entry.
            echo "local-data-ptr: \"$IP $CN.$DOMAIN\"" &&
            echo "local-data: \"$CN.$DOMAIN A $IP\"" &&
            echo "local-data: \"$CN A $IP\"" 
      ) > /var/unbound/openvpn.client.$IP.conf
      /bin/pkill -HUP -F /var/run/

      # CN is not set on delete.
      rm -f /var/unbound/openvpn.client.$IP.conf && /bin/pkill -HUP -F /var/run/


exit 0

This is along with the following row in OpenVPN server custom options:

learn-address "/usr/local/sbin/" 

Finally the following custom options for DNS Resolver:

include: /var/unbound/openvpn.client.*.conf

I'm willing to write a patch if people are interested in having this functionality built-in. I might just duplicate the "Register DHCP leases in the DNS Resolver" checkbox in the "DNS Resolver" configuration. If it is checked, the OpenVPN server automatically will use the script and unbound will include the necessary files.

I'm not quite sure how robust unbound is regarding invalid host names. A bullet-proof learn-address script probably should reject writing invalid unbound config.

Associated revisions

Revision e6e7b00c (diff)
Added by Jim Pingle over 3 years ago

Trim domain for learned DNS entries. Ticket #6847

If the CN is already an FQDN on the given domain, this prevents the
domain from being present in the record twice (e.g.
as a CN leads to records for


#1 Updated by Lorenz Schori over 4 years ago

There is an error in the script. case "$1" in should read case "$OP" in.

#3 Updated by Jim Pingle over 3 years ago

  • Category set to DNS Resolver
  • Status changed from New to Feedback
  • Target version set to 2.4.3
  • % Done changed from 0 to 100

PR was merged on 11/29

#4 Updated by Jim Pingle over 3 years ago

  • Status changed from Feedback to Resolved

Seems to work OK but needed a minor tweak in the script, see e6e7b00c5c

Also available in: Atom PDF