OpenWrt Forum Archive

Topic: DNS Name Resolution using OpenVPN Client

The content of this topic has been archived on 1 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I have a Ubiquiti RS Pro running KAMIKAZE (bleeding edge, r23118). The router works correctly, including
DNS name resolution, except as follows:

In some cases I need to connect the router thru an OpenVPN tunnel to a service provider with a VPN server, and
when I invoke the VPN connection, name resolution stops working. Ie thereafter I can access the internet from the
router by numeric address but not by name.

When connected thru my ISP and further thru OpenVPN, my hookup is as follows, and my ifconfig is below

PC clients/LAN -> OpenWRT Router -> pppoe thru ISP's modem -> internet

    .... AND .....  OpenVPN client tunnel from OpenWRT Router to service provider's VPN server

I note I am new to OpenVPN and I have had difficulties configuring name resolution in my OpenWRT router, even
prior to getting the OpenVPN tunnel working. Per my "find" command below, I see seven different resolv.conf files
on my router, I'm thoroughly confused as to how to configure any or all of them, and it's possible in my attempts
I've screwed up the name resolution/resolv.conf files/links.

What's the right way to set up name resolution on the OpenWRT router in this situation?

root@OpenWrt:~# find / -name resolv.conf
/etc/ppp/resolv.conf
/etc/resolv.conf
/overlay/etc/ppp/resolv.conf
/overlay/etc/resolv.conf
/rom/etc/ppp/resolv.conf
/rom/etc/resolv.conf
/tmp/resolv.conf


root@OpenWrt:~# ifconfig
br-lan    Link encap:Ethernet  HWaddr 00:15:6D:56:11:4D 
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::6488:beff:fed1:924b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2073 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1612 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:338854 (330.9 KiB)  TX bytes:616677 (602.2 KiB)

br-wan    Link encap:Ethernet  HWaddr 00:15:6D:C4:27:09 
          inet6 addr: fe80::b4d8:4bff:fe80:c98a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2877 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2884 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:646006 (630.8 KiB)  TX bytes:377479 (368.6 KiB)

eth0      Link encap:Ethernet  HWaddr 00:15:6D:C4:27:09 
          inet6 addr: fe80::215:6dff:fec4:2709/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2877 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2890 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:686284 (670.1 KiB)  TX bytes:377999 (369.1 KiB)
          Interrupt:4

eth1      Link encap:Ethernet  HWaddr 00:15:6D:C4:27:0A 
          inet6 addr: fe80::215:6dff:fec4:270a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2074 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1621 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:368004 (359.3 KiB)  TX bytes:617293 (602.8 KiB)
          Interrupt:5

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:7 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:574 (574.0 B)  TX bytes:574 (574.0 B)

mon.wlan0 Link encap:UNSPEC  HWaddr 00-15-6D-56-11-4D-00-00-00-00-00-00-00-00-00-00 
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2270 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:136848 (133.6 KiB)  TX bytes:0 (0.0 B)

pppoe-wan Link encap:Point-to-Point Protocol 
          inet addr:189.163.77.47  P-t-P:200.38.193.226  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:1419 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1419 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:567488 (554.1 KiB)  TX bytes:301624 (294.5 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 
          inet addr:10.8.0.142  P-t-P:10.8.0.141  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:5 errors:0 dropped:0 overruns:0 frame:0
          TX packets:134 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:232 (232.0 B)  TX bytes:41006 (40.0 KiB)

wlan0     Link encap:Ethernet  HWaddr 00:15:6D:56:11:4D 
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:112 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:14630 (14.2 KiB)

Hi.

You can add "option dns ..." to any interface in /etc/config/network and add custom/fixed dns server.

Helidude73's up and down scripts worked well for me. The beauty here is that you're using the DNS servers pushed by the OpenVPN server.
https://forum.perfect-privacy.com/showp … ostcount=7

/etc/tun-up

#!/bin/sh
#ACTION=ifup DEVICE=tun0 INTERFACE=vpn /sbin/hotplug-call iface
mv /tmp/resolv.conf.auto /tmp/resolv.conf.auto.hold
echo $foreign_option_1 | sed -e 's/dhcp-option DOMAIN/domain/g' -e 's/dhcp-option DNS/nameserver/g' > /tmp/resolv.conf.auto
echo $foreign_option_2 | sed -e 's/dhcp-option DOMAIN/domain/g' -e 's/dhcp-option DNS/nameserver/g' >> /tmp/resolv.conf.auto
echo $foreign_option_3 | sed -e 's/dhcp-option DOMAIN/domain/g' -e 's/dhcp-option DNS/nameserver/g' >> /tmp/resolv.conf.auto

/etc/tun-down

#!/bin/sh
mv /tmp/resolv.conf.auto.hold /tmp/resolv.conf.auto

I had already tried the first suggestion, and I couldn't get the second method to work.
This may be due to how my service provider's server is set up.

I note that when I'm connected thru openVPN I can reach internet sites using numeric address.
Which of the resolv.conf files I list above is that which is actually used when I'm connected thru
OpenVPN? Is it a file that's persistent across boots, or how is it created?

VPN or no VPN, the resolv file that's used is actually:
/tmp/resolv.conf.auto

OK, here's my /tmp/resolv.conf.auto files and ping results BEFORE invoking OpenVPN:

root@OpenWrt:~# cat /tmp/resolv.conf.auto
nameserver 200.23.242.209
nameserver 200.23.242.225
nameserver 192.168.1.1
nameserver 64.81.127.2
nameserver 205.171.2.65
nameserver 68.94.156.1

root@OpenWrt:~# ping www.google.com
PING www.google.com (66.102.7.104): 56 data bytes
64 bytes from 66.102.7.104: seq=0 ttl=57 time=49.258 ms
etc

And here's my /tmp/resolv.conf.auto files and ping results AFTER invoking OpenVPN:

root@OpenWrt:~# cat /tmp/resolv.conf.auto <------ the same
nameserver 200.23.242.209
nameserver 200.23.242.225
nameserver 192.168.1.1
nameserver 64.81.127.2
nameserver 205.171.2.65
nameserver 68.94.156.1

root@OpenWrt:~# ping www.google.com

...............nothing...........

root@OpenWrt:~# ping 66.102.7.104 <-------- www.google.com numeric address
PING 66.102.7.104 (66.102.7.104): 56 data bytes
64 bytes from 66.102.7.104: seq=0 ttl=51 time=138.020 ms
etc

Can you ping your NS when OpenVPN is running?

Yes I can ping all ot the nameservers in /tmp/resolv.conf.auto when OpenVPN is open

That is odd. Maybe the vpn gateway is filtering? Do you get rebind alarms in logread?

I've put a bunch of what I hope might be relevant information below, taken before during and
after establishing the VPN connection. The logread information information is at the very bottom.
I do not see rebinds as you mention, but I'm an amateur and might not know what to look for.

-------------------------------------------------
Before OpenVPN invoked:

root@OpenWrt:~# cat /tmp/resolv.conf.auto
nameserver 200.23.242.209
nameserver 200.23.242.225
nameserver 192.168.1.1
nameserver 64.81.127.2
nameserver 205.171.2.65
nameserver 68.94.156.1

root@OpenWrt:~# ping www.google.com
PING www.google.com (66.102.7.99): 56 data bytes
64 bytes from 66.102.7.99: seq=0 ttl=57 time=149.459 ms
etc

root@OpenWrt:~# ping 200.23.242.209  <------ nameserver
PING 200.23.242.209 (200.23.242.209): 56 data bytes
64 bytes from 200.23.242.209: seq=0 ttl=253 time=44.094 ms
etc

same for all nameservers

root@OpenWrt:~# cat /etc/openvpn/ovpn017.conf
remote XXX.XXX.XXX.XXX 443
proto tcp-client
ca /etc/openvpn/ca.crt
cert /etc/openvpn/ovpn017.crt
key /etc/openvpn/ovpn017.key
tls-auth /etc/openvpn/ta.key 1
client
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
verb 4
mute 5
tun-mtu 1500
route-method exe
route-delay 2

root@OpenWrt:~# cat /etc/config/network

config 'interface' 'loopback'
        option 'ifname' 'lo'
        option 'proto' 'static'
        option 'ipaddr' '127.0.0.1'
        option 'netmask' '255.0.0.0'

config 'interface' 'lan'
        option 'ifname' 'eth1'
        option 'type' 'bridge'
        option 'proto' 'static'
        option 'ipaddr' '192.168.1.1'
        option 'gateway' '192.168.1.1'
        option 'netmask' '255.255.255.0'
        option 'dns' '192.168.1.1 64.81.127.2 205.171.2.65 68.94.156.1'

config 'interface' 'wan'
        option 'ifname' 'eth0'
        option 'proto' 'pppoe'
        option 'username' 'aaannnnnnn'
        option 'password' 'nnnnnnn'
        option 'defaultroute' '1'
        option 'dns' '200.23.242.209 200.23.242.225'
        option 'type' 'bridge'
        option 'ipaddr' '189.163.65.250'
        option 'gateway' '200.38.193.226'
        option 'ppp_redial' 'demand'

config 'switch'
        option 'name' 'eth1'
        option 'reset' '1'
        option 'enable_vlan' '1'

config 'switch_vlan'
        option 'device' 'eth1'
        option 'vlan' '1'
        option 'ports' '0 1 2 3 4'

-------------------------------------------------------------------
During/after OpenVPN invoked:

root@OpenWrt:~# openvpn --config /etc/openvpn/ovpn017.conf
Wed Sep 29 18:45:31 2010 us=16140 OpenVPN 2.1.3 mips-openwrt-linux [SSL] [LZO2] built on Sep 24 2010
Wed Sep 29 18:45:31 2010 us=16610 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Sep 29 18:45:31 2010 us=16718 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Sep 29 18:45:31 2010 us=252741 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Wed Sep 29 18:45:31 2010 us=252941 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 29 18:45:31 2010 us=253073 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 29 18:45:31 2010 us=253693 Control Channel MTU parms [ L:1543 D:168 EF:68 EB:0 ET:0 EL:0 ]
Wed Sep 29 18:45:31 2010 us=253971 Socket Buffers: R=[87380->131072] S=[16384->131072]
Wed Sep 29 18:45:31 2010 us=254137 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Wed Sep 29 18:45:31 2010 us=254295 Attempting to establish TCP connection with 75.126.229.136:443 [nonblock]
Wed Sep 29 18:45:32 2010 us=294860 TCP connection established with 75.126.229.136:443
Wed Sep 29 18:45:32 2010 us=295039 TCPv4_CLIENT link local: [undef]
Wed Sep 29 18:45:32 2010 us=295144 TCPv4_CLIENT link remote: XXX.XXX.XXX.XXX:443
Wed Sep 29 18:45:32 2010 us=377118 TLS: Initial packet from XXX.XXX.XXX.XXX:443, sid=2d9b0ab6 6ed0d05a
Wed Sep 29 18:45:33 2010 us=251644 VERIFY OK: depth=1,
Wed Sep 29 18:45:33 2010 us=253905 VERIFY OK: depth=0,
Wed Sep 29 18:45:34 2010 us=850793 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 29 18:45:34 2010 us=850991 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 29 18:45:34 2010 us=851395 NOTE: --mute triggered...
Wed Sep 29 18:45:34 2010 us=851820 3 variation(s) on previous 5 message(s) suppressed by --mute
Wed Sep 29 18:45:34 2010 us=851946 [ovpn017] Peer Connection Initiated with 75.126.229.136:443
Wed Sep 29 18:45:37 2010 us=172718 SENT CONTROL [ovpn017]: 'PUSH_REQUEST' (status=1)
Wed Sep 29 18:45:37 2010 us=346505 PUSH: Received control message: 'PUSH_REPLY,socket-flags TCP_NODELAY,route-delay 2,dhcp-option DNS 216.131.95.20,dhcp-option DNS 216.131.94.5,route-metric 1,redirect-gateway def1,route 10.8.0.137,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.142 10.8.0.141'
Wed Sep 29 18:45:37 2010 us=347035 OPTIONS IMPORT: timers and/or timeouts modified
Wed Sep 29 18:45:37 2010 us=347152 OPTIONS IMPORT: --socket-flags option modified
Wed Sep 29 18:45:37 2010 us=347344 OPTIONS IMPORT: --ifconfig/up options modified
Wed Sep 29 18:45:37 2010 us=347460 NOTE: --mute triggered...
Wed Sep 29 18:45:37 2010 us=394734 3 variation(s) on previous 5 message(s) suppressed by --mute
Wed Sep 29 18:45:37 2010 us=394874 TUN/TAP device tun0 opened
Wed Sep 29 18:45:37 2010 us=394987 TUN/TAP TX queue length set to 100
Wed Sep 29 18:45:37 2010 us=395210 /sbin/ifconfig tun0 10.8.0.142 pointopoint 10.8.0.141 mtu 1500
Wed Sep 29 18:45:39 2010 us=560776 /sbin/route add -net XXX.XXX.XXX.XXX netmask 255.255.255.255 gw 200.38.193.226
Wed Sep 29 18:45:39 2010 us=564047 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.141
Wed Sep 29 18:45:39 2010 us=607335 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.141
Wed Sep 29 18:45:39 2010 us=611046 /sbin/route add -net 10.8.0.137 netmask 255.255.255.255 gw 10.8.0.141 metric 1
Wed Sep 29 18:45:39 2010 us=614210 Initialization Sequence Completed

root@OpenWrt:~# cat /tmp/resolv.conf.auto
nameserver 200.23.242.209
nameserver 200.23.242.225
nameserver 192.168.1.1
nameserver 64.81.127.2
nameserver 205.171.2.65
nameserver 68.94.156.1

root@OpenWrt:~# ping www.google.com

(no response)

root@OpenWrt:~# ping 200.23.242.209         <--------nameserver
PING 200.23.242.209 (200.23.242.209): 56 data bytes
64 bytes from 200.23.242.209: seq=0 ttl=245 time=300.739 ms
etc

same for all nameservers

root@OpenWrt:~# logread

(omitting lots of stuff before openvpn is invoked .... note times)
Sep 29 17:59:51 OpenWrt daemon.info pppd[509]: PPP session is 51718
Sep 29 17:59:51 OpenWrt daemon.info pppd[509]: Using interface pppoe-wan
Sep 29 17:59:51 OpenWrt daemon.notice pppd[509]: Connect: pppoe-wan <--> br-wan
Sep 29 17:59:54 OpenWrt daemon.notice pppd[509]: PAP authentication succeeded
Sep 29 17:59:54 OpenWrt daemon.notice pppd[509]: peer from calling number 00:18:B9:2C:73:1A authorized
Sep 29 17:59:54 OpenWrt daemon.notice pppd[509]: replacing old default route to br-lan [192.168.1.1]
Sep 29 17:59:54 OpenWrt daemon.notice pppd[509]: local  IP address 189.177.246.87
Sep 29 17:59:54 OpenWrt daemon.notice pppd[509]: remote IP address 200.38.193.226
Sep 29 17:59:54 OpenWrt user.info firewall: adding wan (pppoe-wan) to zone wan
Sep 29 17:59:55 OpenWrt user.notice root: starting ntpclient
Sep 29 17:59:55 OpenWrt daemon.notice ntpd[2973]: ntpd 4.2.6p2@1.2194 Sun Sep 26 21:56:26 UTC 2010 (1)
Sep 29 17:59:55 OpenWrt daemon.notice ntpd[2975]: proto: precision = 5.417 usec
Sep 29 17:59:55 OpenWrt daemon.debug ntpd[2975]: ntp_io: estimated max descriptors: 1024, initial socket boundary: 16
Sep 29 17:59:55 OpenWrt daemon.err ntpd[2975]: unable to bind to wildcard address 0.0.0.0 - another process may be running - EXITING
Sep 29 17:59:55 OpenWrt user.notice rdate: Synced with cudns.cit.cornell.edu
Sep 29 18:34:58 OpenWrt authpriv.info dropbear[3013]: Child connection from ::ffff:192.168.1.17:46986
Sep 29 18:35:03 OpenWrt authpriv.notice dropbear[3013]: password auth succeeded for 'root' from ::ffff:192.168.1.17:46986
Sep 29 18:36:17 OpenWrt authpriv.info dropbear[3019]: Child connection from ::ffff:192.168.1.17:46990
Sep 29 18:36:23 OpenWrt authpriv.notice dropbear[3019]: password auth succeeded for 'root' from ::ffff:192.168.1.17:46990
Sep 29 18:45:37 OpenWrt user.info kernel: tun0: Disabled Privacy Extensions

Here's what you need to do:

In your /etc/openvpn folder make a new file, say "updns"  and another called "downdns" - I use wincp to set permissions, but unless using windows, you will need to chmod both to 755.

Put this into /etc/openvpn/updns:

#!/bin/sh
mv /tmp/resolv.conf.auto /tmp/resolv.conf.auto.hold
echo $foreign_option_1 | sed -e 's/dhcp-option DOMAIN/domain/g' -e 's/dhcp-option DNS/nameserver/g' > /tmp/resolv.conf.auto
echo $foreign_option_2 | sed -e 's/dhcp-option DOMAIN/domain/g' -e 's/dhcp-option DNS/nameserver/g' >> /tmp/resolv.conf.auto
echo $foreign_option_3 | sed -e 's/dhcp-option DOMAIN/domain/g' -e 's/dhcp-option DNS/nameserver/g' >> /tmp/resolv.conf.auto

Put this into /etc/openvpn/downdns:

#!/bin/sh
mv /tmp/resolv.conf.auto.hold /tmp/resolv.conf.auto


Now add this to your xxx.ovpn file:

script-security 2 system
up "/etc/openvpn/updns"
down "/etc/openvpn/downdns"


If the  VPN service provider requires a Username and Password, create a file called password.txt in /etc/openvpn put your username on the first line and your password on the second.

Then add this to your  xxxx.ovpn config:

auth-user-pass password.txt


You might need this in the file /etc/config/firewall (or maybe that common port is already open?):

config 'rule'
    option 'src' 'wan'
    option 'proto' 'tcp'
    option 'dest_port' '443'
    option 'target' 'ACCEPT'


Put this in /etc/firewall.user

iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I INPUT -i tun+ -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -I POSTROUTING -o tun+ -j MASQUERADE


If you want openvpn to start automatically when the router boots, then add this to /etc/rc.local:

openvpn --cd /etc/openvpn --daemon --config xxxxx.ovpn


Lastly, if it works, don't fix it - but I don't know why you are not just using a standard wan, without ppoe and without wan bridging to connect to the modem. The ISP's modem will normally give the router an IP address and it should just work - just set the router to something other than 192.168.1.1 - maybe 192.168.11.1, but it may even work anyway.

Thanks to Paulxx for the detailed instructions, and I think they are on the
right track. But before I try them I's like to clear up some confusion I have
about which resolv.conf files are actually being used for name resolution.

Below is an experiment - during which I'm connected thru my ISP telmex in Mexico
but NOT thru my VPN provider in the United States. Unless I'm confused, I think the
experiment shows that the file /etc/ppp/resolv.conf is being used for name resolution.
not the file /tmp/resolv.conf.auto. If so, would the echo commands in the script
above be altered to put the derived nameservers in /etc/ppp/resolv.conf?

(To answer the question above regards "standard wan, without ppoe and without wan
bridging", the ISP here is Telmex, and they provide a 2-wire 2701 modem/router/wap
which itself connects to their service thru pppoe. But in order to use the Ubiquiti
RS Pro behind it, the 2-wire routing function must be disabled and the 2-wire
reconfigured to be a modem only, and the Ubiquiti must connect using pppoe
thru the 2-wire modem, using the username and password provided by Telmex.

With all that in mind, the nameservers in /tmp/resolv.conf.auto are apparently
obtained from Telmex, although I confess I don't understand how. But per my experiment,
I think the nameservers actually used by OpenWrt are those in /etc/ppp/resolv.conf)

(reboot router to initialize everything)

root@OpenWrt:~# ls -l /tmp/resolv.conf.auto
-rw-r--r--    1 root     root            52 Dec 31  1969 /tmp/resolv.conf.auto

root@OpenWrt:~# cat /tmp/resolv.conf.auto
nameserver 200.23.242.209
nameserver 200.23.242.225

root@OpenWrt:~# ls -l /etc/ppp/resolv.conf
-rw-r--r--    1 root     root           153 Oct  2 07:26 /etc/ppp/resolv.conf

root@OpenWrt:~# cat /etc/ppp/resolv.conf
nameserver 64.81.127.2
# nameserver 205.171.2.65

root@OpenWrt:~# dig google.com NS

; <<>> DiG 9.6.1-P2 <<>> google.com NS
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46516
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.                    IN      NS

;; ANSWER SECTION:
google.com.             168357  IN      NS      ns1.google.com.
google.com.             168357  IN      NS      ns2.google.com.
google.com.             168357  IN      NS      ns3.google.com.
google.com.             168357  IN      NS      ns4.google.com.

;; Query time: 87 msec
;; SERVER: 64.81.127.2#53(64.81.127.2)
;; WHEN: Sat Oct  2 08:04:28 2010
;; MSG SIZE  rcvd: 100

root@OpenWrt:~# vi /etc/ppp/resolv.conf

root@OpenWrt:~# cat /etc/ppp/resolv.conf
# nameserver 64.81.127.2
nameserver 205.171.2.65

root@OpenWrt:~# dig google.com NS

; <<>> DiG 9.6.1-P2 <<>> google.com NS
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15005
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.                    IN      NS

;; ANSWER SECTION:
google.com.             42572   IN      NS      ns4.google.com.
google.com.             42572   IN      NS      ns1.google.com.
google.com.             42572   IN      NS      ns3.google.com.
google.com.             42572   IN      NS      ns2.google.com.

;; Query time: 55 msec
;; SERVER: 205.171.2.65#53(205.171.2.65)
;; WHEN: Sat Oct  2 08:05:49 2010
;; MSG SIZE  rcvd: 100

The discussion might have continued from here.