Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 4 down vote favorite
1

I need some sort of "safeguard" for my VPN connection. If the connection drops, the machine shouldn't even reach the internet. (I can reach the machine by other means.)

Is it possible somehow?
If I remember correctly, there are some "safeguards" for Windows, but I never heard about such a solution for Linux. Not to mention for cli.

share|improve this question
You need to verify your connection on the server or the client? – Tim Jul 27 '12 at 12:51
Client. If the client drops the connection, the machine should try re-connecting or remain unreachable. But it shouldn't ever use the normal ISP connection. – Shiki Jul 27 '12 at 14:12
Think of it as a safebox. You live in a country where internet is not free. You create a passworded (encrypted) VM and you have openvpn inside that box. You can use SSH or even use the VM as your own environment. But: If openvpn goes down, the connection is public. | Now how do you solve that? :) – Shiki Jul 27 '12 at 14:36
Ps.: No I don't live in such a country, just an example about a use case. – Shiki Jul 27 '12 at 14:36

1 Answer

up vote 2 down vote accepted

You can use the down directive in your client configuration to fire off a custom script when the connection drops. In the script, you could do several things for limiting public network connections. Here's my ideas:

  • Setup some iptables that only allow connections to the VPN server, all other connections dropped. Of course, do not forget to remove this restriction when the client comes back up
  • Modify the resolv.conf file to limit or turn off name resolution
  • Incorporate custom routing tables
share|improve this answer
Now that is neat. – Shiki Jul 28 '12 at 7:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.