Why proprietary VPN daemons wreck your DNS on Ubuntu and Debian, and how to switch to clean WireGuard networking that restores cleanly every time.
Tired of fixing your system resolver after disconnecting?
If you are reading this, chances are you just typed a disconnect command in your terminal, switched over to your browser to check something, and were greeted by a sudden connection error. You opened your terminal again, tried pinging a common domain, and got the dreaded message: Temporary failure in name resolution.
Then you checked /etc/resolv.conf. Instead of the standard symlink pointing to your local stub resolver, you found either a hardcoded pair of external nameservers that only route when the tunnel is active, an empty file, or a broken symlink left behind by a background daemon.
It is one of the most frustrating paper cuts on Linux, particularly on modern Ubuntu and Debian installations. You set up a commercial VPN to protect your traffic, and instead, it manages your system networking with the delicacy of a sledgehammer.
Before getting into alternatives, here is the immediate fix to get your machine back online right now:
If your distribution uses systemd-resolved, which has been standard on Ubuntu and many Debian desktop systems for years, check the status of /etc/resolv.conf using ls -l /etc/resolv.conf. If the file is a static text file rather than a link, or if the link points to a non-existent path, restore the canonical symlink by running: sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf, followed by restarting the service with sudo systemctl restart systemd-resolved. If your system relies on classic resolvconf or openresolv under NetworkManager, restarting NetworkManager or regenerating the resolvconf cache usually brings local DHCP nameservers back.
Once you are back online, the bigger question remains: why does this keep happening, and why do so many commercial Linux VPN clients struggle with something as fundamental as DNS restoration?
The root of the issue lies in how proprietary clients are architected. Many mainstream VPN providers build a single monolithic client designed primarily for Windows or macOS, and then package a background daemon for Linux that assumes it has unilateral control over network routing.
On modern Linux distributions, DNS resolution is not just a single static text file. It is a dynamic, multi-layered stack. NetworkManager handles local interface states; systemd-resolved listens on 127.0.0.53 to provide split-DNS, caching, and local domain fallback; and utilities like resolvconf manage prioritized subscriptions to nameservers.
When a proprietary daemon like NordVPN's Linux service takes over, it frequently overwrites /etc/resolv.conf directly or injects custom firewall rules to divert port 53. If the daemon crashes, if your system suspends and resumes, or if the client disconnects unexpectedly, those teardown hooks never execute cleanly. The tunnel drops, but your network stack is left pointing to tunnel-internal resolvers that are no longer reachable.
When people start looking for a Linux VPN, they usually evaluate options based on desktop marketing metrics: how many country locations are available, whether there is a one-line apt repository installer, or whether the command-line interface has lots of flags.
After spending an afternoon debugging broken name resolution, those criteria usually change completely. The real standard for a solid Linux VPN is much simpler: does it respect native networking conventions, and does it leave your system clean when it exits?
This is why experienced Linux users tend to move away from heavy, proprietary background daemons and migrate toward standard WireGuard configurations or lightweight clients that adhere to system tools.
Standard WireGuard implementations handle DNS through existing system hooks like resolvconf or systemd-resolved directly via the standard openresolv interface. When the interface comes up, it registers its DNS with your system's priority queue. When the interface goes down, the kernel interface disappears and the system automatically restores your primary DHCP or static resolver. There is no background watcher process fighting your desktop environment, and no arbitrary file clobbering.
If you are looking for a privacy-focused VPN that fits this exact workflow without the administrative headache, ONLYDOGSVPN is built with this Linux reality in mind.
Instead of forcing you to run an invasive system service that meddles with system files, ONLYDOGSVPN prioritizes clean, standards-compliant WireGuard tunnels and predictable connection management. It treats your operating system like a proper Linux environment, not an appliance to overwrite. When you connect, routing and DNS are scoped cleanly to the tunnel interface. When you disconnect, your native network configuration returns to its default state without leaving dead records in your resolver.
To be fair and transparent, ONLYDOGSVPN might not be what everyone is looking for. If you prefer an Electron-based desktop app with an animated world map, or if you rely on dozens of proprietary bells and whistles bundled into an opaque binary, mainstream retail VPNs invest heavily in those interfaces.
However, if your primary goal is reliable privacy, fast throughput, and a setup that never forces you to manually recreate symlinks just to browse the web after disconnecting, switching to a lean WireGuard-friendly provider like ONLYDOGSVPN is a relief.
A VPN should secure your outbound traffic, not break your ability to resolve hostnames on your own workstation. Choosing a service that respects standard Linux network plumbing saves you time, prevents terminal headaches, and keeps your system doing what it was configured to do.