From 3dd24ff4a2b6e14fc76c238f8a31ffc8cc1348bf Mon Sep 17 00:00:00 2001
From: devopsoffice-ivan <46262452+devopsoffice-ivan@users.noreply.github.com>
Date: Sun, 12 Oct 2025 17:01:04 +0200
Subject: [PATCH] OpenVPN: allow multiple domains settings for client
 connection (#9281)

* OpenVPN: allow multiple domains settings for client connection

* OpenVPN: allow multiple domains settings - update plugin files

---------

Co-authored-by: Krisztian Ivancso <dev@devopsoffice.com>
---
 src/etc/inc/plugins.inc.d/openvpn.inc                    | 4 +++-
 .../app/controllers/OPNsense/OpenVPN/forms/dialogCSO.xml | 8 +++++---
 .../OPNsense/OpenVPN/forms/dialogInstance.xml            | 9 +++++----
 src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.php | 4 +++-
 src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.xml | 8 ++++++--
 5 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/src/etc/inc/plugins.inc.d/openvpn.inc b/src/etc/inc/plugins.inc.d/openvpn.inc
index d38a1850a5..5e1e15ebf0 100644
--- a/src/etc/inc/plugins.inc.d/openvpn.inc
+++ b/src/etc/inc/plugins.inc.d/openvpn.inc
@@ -365,7 +365,9 @@ function openvpn_validate_cidr($value, $name, $multiple = false, $ipproto = 'ipv
 function openvpn_add_dhcpopts(&$settings, &$conf)
 {
     if (!empty($settings['dns_domain'])) {
-        $conf .= "push \"dhcp-option DOMAIN {$settings['dns_domain']}\"\n";
+        foreach (explode(",", $settings['dns_domain']) as $domain) {
+            $conf .= "push \"dhcp-option DOMAIN {$domain}\"\n";
+        }
     }
     if (!empty($settings['dns_domain_search'])) {
         foreach (explode(",", $settings['dns_domain_search']) as $domain) {
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/OpenVPN/forms/dialogCSO.xml b/src/opnsense/mvc/app/controllers/OPNsense/OpenVPN/forms/dialogCSO.xml
index 51225ab5be..8501a86458 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/OpenVPN/forms/dialogCSO.xml
+++ b/src/opnsense/mvc/app/controllers/OPNsense/OpenVPN/forms/dialogCSO.xml
@@ -150,9 +150,11 @@
     </field>
     <field>
         <id>cso.dns_domain</id>
-        <label>DNS Default Domain</label>
-        <type>text</type>
-        <help>Set Connection-specific DNS Suffix.</help>
+        <label>DNS Domain List</label>
+        <type>select_multiple</type>
+        <style>tokenize</style>
+        <allownew>true</allownew>
+        <help>Set Connection-specific DNS Suffixes.</help>
         <grid_view>
             <visible>false</visible>
         </grid_view>
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/OpenVPN/forms/dialogInstance.xml b/src/opnsense/mvc/app/controllers/OPNsense/OpenVPN/forms/dialogInstance.xml
index 1a1b7bb2d2..e158916921 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/OpenVPN/forms/dialogInstance.xml
+++ b/src/opnsense/mvc/app/controllers/OPNsense/OpenVPN/forms/dialogInstance.xml
@@ -598,10 +598,11 @@ Set to 0 to disable, remember to change your client as well.
     </field>
     <field>
         <id>instance.dns_domain</id>
-        <label>DNS Default Domain</label>
-        <type>text</type>
-        <style>role role_server</style>
-        <help>Set Connection-specific DNS Suffix.</help>
+        <label>DNS Domain list</label>
+        <type>select_multiple</type>
+        <style>tokenize role role_server</style>
+        <allownew>true</allownew>
+        <help>Set Connection-specific DNS Suffixes.</help>
         <grid_view>
             <visible>false</visible>
         </grid_view>
diff --git a/src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.php b/src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.php
index 85f680edc9..8ec7c01cf3 100644
--- a/src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.php
+++ b/src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.php
@@ -664,7 +664,9 @@ class OpenVPN extends BaseModel
                         $options['push'][] = "\"register-dns\"";
                     }
                     if (!$node->dns_domain->isEmpty()) {
-                        $options['push'][] = "\"dhcp-option DOMAIN {$node->dns_domain}\"";
+                        foreach (explode(',', (string)$node->dns_domain) as $opt) {
+                            $options['push'][] = "\"dhcp-option DOMAIN {$opt}\"";
+                        }
                     }
                     if (!$node->dns_domain_search->isEmpty()) {
                         foreach (explode(',', (string)$node->dns_domain_search) as $opt) {
diff --git a/src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.xml b/src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.xml
index 7c67c8f410..e715e74dc0 100644
--- a/src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.xml
+++ b/src/opnsense/mvc/app/models/OPNsense/OpenVPN/OpenVPN.xml
@@ -57,7 +57,9 @@
                     <Default>0</Default>
                     <Required>Y</Required>
                 </register_dns>
-                <dns_domain type="HostnameField"/>
+                <dns_domain type="HostnameField">
+                    <AsList>Y</AsList>
+                </dns_domain>
                 <dns_domain_search type="HostnameField">
                     <AsList>Y</AsList>
                 </dns_domain_search>
@@ -350,7 +352,9 @@
                     <Default>0</Default>
                     <Required>Y</Required>
                 </register_dns>
-                <dns_domain type="HostnameField"/>
+                <dns_domain type="HostnameField">
+                    <AsList>Y</AsList>
+                </dns_domain>
                 <dns_domain_search type="HostnameField">
                     <AsList>Y</AsList>
                 </dns_domain_search>