diff --git a/wgengine/router/router_linux.go b/wgengine/router/router_linux.go
index ea28c3450..fd101ef91 100644
--- a/wgengine/router/router_linux.go
+++ b/wgengine/router/router_linux.go
@@ -163,11 +163,18 @@ func (r *linuxRouter) Close() error {
 }
 
 // Set implements the Router interface.
-func (r *linuxRouter) Set(cfg *Config) error {
+func (r *linuxRouter) Set(cfg *Config) (err error) {
 	if cfg == nil {
 		cfg = &shutdownConfig
 	}
 
+	defer func() {
+		if err != nil {
+			// restore /etc/resolv.conf to its original state.
+			r.dns.Set(dns.Config{})
+		}
+	}()
+
 	if err := r.setNetfilterMode(cfg.NetfilterMode); err != nil {
 		return err
 	}