Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to ensure that my VPN is started and running, before any TCP traffic from any of my background services send or receive data. How can I guarantee that this is the case?

How do I handle the special case where I connect to a Wifi access point (in Starbucks) that requires me to press "I Agree" prior to continuing my session?

share|improve this question

You can use iptables to do this, probably. At least if "goes over the VPN" is something that iptables can see, for example, its a separate tunnel device. Assuming the vpn is device "vpn", something like:

iptables -P OUTPUT DROP
iptables -A OUTPUT -o vpn -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# dhcp
iptables -A OUTPUT -p udp --sport 68 --dport 67 -j ACCEPT # DHCP

# "I Agree"
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT # DNS/UDP
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT # DNS/TCP
iptables -A OUTPUT -p tcp --dport 80 -m owner --uid-owner your-userid -j ACCEPT

The last three rules are to allow you to get to the "I Agree" webpage. After you've clicked the "I accept" button and your VPN is up, you can get rid of them. Note that its possible for some stuff to leak out during that period, in particular DNS lookups. Avoiding that is much more difficult.

(Untested, I suggest having wireshark installed and running to debug if need be. I'm pretty sure its right, but am least confident about that DHCP line. It may not allow enough... If you don't get an IP address, that's what's wrong)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.