ANSWERED No DNS on AirVPN Suite on an Ubuntu Container

[Titums 3]

I have a server running Ubuntu 24 with a K3S node setup.  I'm trying to set yup a pod with Ubuntu 24 and XFCE.  The base image I'm basing mine off of is jrei/systemd-ubuntu:24.04.  

I've got it mostly working, there are just two issues.  One is auto start and the other is DNS.  This post is focusing on the DNS issue.  Before bluetit starts DNS works just fine.  After the connection is established DNS no longer works.

In the logs I see this error:
   VPN Server has pushed IPv4 DNS server 10.65.2.1
   ERROR: Cannot create a backup copy of resolv.conf

I updated permission on the location I assume it's trying to back up to.
   sudo chmod 770 /etc/airvpn

Then restarted bluetit, still getting the error and now DNS.

If I manually set the dns server in /etc/resolv.conf it starts to "work" google works well, but any other web site is slow to resolve if it does at all.  Most items don't resolve as all.

The container config in K3S doesn't do anything special, it just uses default dns config.  I did have to update CoreDNS, with "forward . 192.168.1.1" to get the pod's dns working before bluetit was started.

What else would cause that error message?  Anything else I should be looking into?  
Thanks for your help.  

[Staff 10568]

On 6/22/2026 at 4:05 AM, Titums said:

What else would cause that error message?  Anything else I should be looking into?  

Hello!

Thank you for your patience to reply to the numerous questions by the support team on your ticket. We re-publish the outcome here for Kubernetes users' and readers' comfort, and for future reference.
 

On 6/22/2026 at 4:05 AM, Titums said:

VPN Server has pushed IPv4 DNS server 10.65.2.1
   ERROR: Cannot create a backup copy of resolv.conf

Bluetit relies on filesystem-level operation to create the resolv.conf backup. In your setup, /etc/airvpn and /etc/resolv.conf are in different file systems. Therefore Linux kernel will return EXDEV ("cross-device link") error when Bluetit tries to move, via stdlib rename() method, /etc/resolv.conf into /etc/airvpn/ 

Possible work-around:

1. Have /etc/airvpn and /etc/resolv.conf into the same file system, OR
2. don't allow Bluetit to manage DNS by setting, inside bluetit.rc run control file, this directive: ignorednspush on and let the pod manage the DNS. You will not use anymore VPN DNS, but DNS queries will be tunneled anyway. You can still set your favorite DNS (even VPN DNS, if needed), but you have to set it manually.

In a future Bluetit version we'll see how to improve Suite compatibility with Kubernetes (and possibly other environments).

Kind regards
 

[Titums 3]

Followup / Final state:

Working with tech support we were never able to get the dns to reliably self update.  We tried many things and none of them worked consistently.  We also established that OpenVpn had some serious performance issues. When I switched to wireguard this cleared up.  Per a couple to forum posts and checking a dozen servers, wire guard connections always use the same DNS server IP, which is convenient.

The pod boots up using default K3S dns, this is required for the vpn address to resolve.
bluetit.rc has ignorednspush set to yes.
A script monitors the journal and after the connection completes it re-writes resolv.conf with the correct ip.
I created scripts for start/stop functions that also update resolve.conf appropriately.

Additional notes:
I had to modify the suites install script to work properly and skip a few validation step which weren't possible while the docker image was built.
To help make restarts and connect on start up reliable, I had to add a shut down script to trigger vpn disconnect and set K3S roll out strategy to replace so the old pod would be fully shut down before the new comes up as the /etc/airvpn dir is mounted to a host path so all the setting and config could survive reboots.
To get wireguard to work properly we had to allow the pod to use /lib/modules from the host.