Yes, it is possible to use an OpenVPN server's DNS for name resolution while not routing the rest of your non-DNS traffic through the VPN. This is often referred to as "split-DNS" or "split-tunneling" for DNS only.

How to Achieve This

1. Split-Tunneling Configuration

• By default, OpenVPN routes all traffic through the VPN. To exclude non-DNS traffic, you need to configure split-tunneling.

• In your OpenVPN client configuration file (.ovpn), add or modify the following directives:

  ini

  Copy

  redirect-gateway def1 bypass-dhcp

  Remove or comment out this line if you want to exclude all non-DNS traffic from the VPN tunnel.

• Instead, explicitly define which traffic should go through the VPN (e.g., only DNS queries):

  ini

  Copy

  route <VPN_SERVER_IP> 255.255.255.255

  Replace <VPN_SERVER_IP> with the IP address of your OpenVPN server.

2. DNS-Specific Routing

• To ensure only DNS queries are routed through the VPN, you need to:
  1. Push the VPN's DNS server to the client:
     ini

     Copy

     dhcp-option DNS <VPN_DNS_IP>

     Replace <VPN_DNS_IP> with the IP of the DNS server you want to use (e.g., the OpenVPN server's DNS or a custom DNS like 8.8.8.8).
  2. Prevent the VPN from overriding the default gateway for all traffic. Remove or avoid:
     ini

     Copy

     redirect-gateway

3. Client-Side Configuration (Advanced)

• On Linux/macOS, you can manually configure routing tables to ensure only DNS traffic goes through the VPN:
  bash

  Copy

  ip route add <VPN_DNS_IP> via <VPN_GATEWAY_IP> dev tun0

  Replace <VPN_DNS_IP> with the DNS server IP and <VPN_GATEWAY_IP> with the VPN gateway.
• On Windows, use the route command:
  cmd

  Copy

  route add <VPN_DNS_IP> mask 255.255.255.255 <VPN_GATEWAY_IP>

4. Firewall Rules (Optional)

• Use iptables (Linux) or Windows Firewall to enforce that only DNS (UDP/53 and TCP/53) traffic is allowed through the VPN interface (tun0 or similar).

Example OpenVPN Client Configuration

Here’s a minimal example for a client config file:

client
dev tun
proto udp
remote your-vpn-server.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
cipher AES-256-CBC
verb 3

# Push DNS but do NOT redirect all traffic
dhcp-option DNS 10.8.0.1  # Replace with your VPN DNS
# No redirect-gateway line

Key Notes

• DNS Leak Protection: If you want to ensure DNS queries only use the VPN's DNS, enable block-outside-dns in the client config:
  ini

  Copy

  block-outside-dns

• Testing: Verify your setup with tools like:
  • nslookup or dig to check DNS resolution.
  • traceroute or curl ifconfig.me to confirm non-DNS traffic bypasses the VPN.

Would you like help troubleshooting a specific setup or platform (e.g., Windows, Linux, or a router)?