The openvpn 2.7 package runs its default dns-updown script, which writes nameservers pushed by the server into /etc/resolv.conf. That file is owned by vyos-hostsd, and VyOS renders neither its own handler nor dns-updown disable. So a VyOS OpenVPN client whose server pushes DNS gets the VPN's resolver as its first nameserver without any configuration asking for it, and the next hostsd render removes it while the tunnel stays up.

Steps:

1. OpenVPN client (any server that pushes dhcp-option DNS, for example a VyOS server with server name-server).
2. Connect, read /etc/resolv.conf.
3. set system name-server <x>, commit, read /etc/resolv.conf again.

After connect:

### openvpn vtun31 begin ###
nameserver 10.231.0.1
search l152.example
### openvpn vtun31 end ###
### Autogenerated by VyOS ###

After the commit the block is gone, and the client is still connected:

### Autogenerated by VyOS ###
### Do not edit, your changes will get overwritten ###


# system
nameserver 192.168.176.1

After the client is killed the block stays, and the restart adds a second one.

Workaround: openvpn-option "--dns-updown disable" on the client.

Impact: the router's own DNS changes when an OpenVPN client connects, and changes back on an unrelated commit.

Suggested fix: render dns-updown disable for every OpenVPN interface; if pushed DNS should be used, pass it to vyos-hostsd instead.