Yes, it is possible to configure OpenVPN on Debian 13 (Trixie) with GNOME to use the VPN server's DNS for name resolution while excluding all other traffic from being routed through the VPN. This is often called a "split-DNS" or "DNS-only VPN" setup.

How to Achieve This

1. OpenVPN Client Configuration

In your OpenVPN client configuration file (e.g., /etc/openvpn/client/client.conf), ensure the following directives are set:

# Use the VPN's DNS server
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

# Prevent all traffic from being routed through the VPN
redirect-gateway def1 bypass-dhcp

However, redirect-gateway is what routes all traffic through the VPN. To avoid this, you should omit or comment out the redirect-gateway directive entirely.

Instead, use:

# Only push DNS settings, do not redirect the default gateway
pull-filter ignore "redirect-gateway"

This ensures that only DNS settings are applied, and no traffic is routed through the VPN.

2. DNS Configuration

To ensure DNS queries are sent through the VPN while other traffic is not, you need to:

• Use resolvconf or systemd-resolved to manage DNS settings dynamically.
• Prevent DNS leaks by ensuring DNS queries are not sent to your ISP's DNS servers.

Option A: Using resolvconf

1. Install resolvconf (if not already installed):
   bash

   Copy

   sudo apt install resolvconf

2. Ensure your OpenVPN configuration includes:
   ini

   Copy

   script-security 2
   up /etc/openvpn/update-resolv-conf
   down /etc/openvpn/update-resolv-conf

3. The update-resolv-conf script will automatically update DNS settings when the VPN connects/disconnects.

Option B: Using systemd-resolved

1. Enable and start systemd-resolved:
   bash

   Copy

   sudo systemctl enable --now systemd-resolved

2. Configure OpenVPN to use systemd-resolved for DNS:
   ini

   Copy

   script-security 2
   up /etc/openvpn/update-systemd-resolved
   down /etc/openvpn/update-systemd-resolved

   (You may need to create or download the update-systemd-resolved script.)

3. Verify DNS Leak Protection

After connecting to the VPN, verify that:

• DNS queries are resolved by the VPN's DNS server.
• Other traffic is not routed through the VPN.

Use tools like:

• nslookup example.com (check which DNS server is used)
• curl ifconfig.me (check your public IP)
• DNS Leak Test (web-based)

4. Firewall Rules (Optional)

If you want to explicitly block non-DNS traffic from using the VPN interface, you can add iptables rules:

# Allow DNS traffic (UDP 53) through the VPN
sudo iptables -A OUTPUT -o tun0 -p udp --dport 53 -j ACCEPT

# Block all other traffic through the VPN
sudo iptables -A OUTPUT -o tun0 -j DROP

(Replace tun0 with your VPN interface name.)

Summary of Key Points

Final Notes

• This setup is useful for accessing internal resources (e.g., company intranet) via VPN while keeping regular internet traffic on your local connection.
• If your VPN provider pushes redirect-gateway, you must use pull-filter ignore "redirect-gateway" to override it.
• Test thoroughly to ensure DNS queries are not leaking.

Would you like help creating the update-resolv-conf or update-systemd-resolved scripts?