How do I ensure outbound TCP/IP traffic always uses a VPN, even when using Wifi?

Question

I'd like to ensure that my VPN is started and running, before any TCP traffic from any of my background services send or receive data. How can I guarantee that this is the case?

How do I handle the special case where I connect to a Wifi access point (in Starbucks) that requires me to press "I Agree" prior to continuing my session?

Answer 1

You can use iptables to do this, probably. At least if "goes over the VPN" is something that iptables can see, for example, its a separate tunnel device. Assuming the vpn is device "vpn", something like:

iptables -P OUTPUT DROP
iptables -A OUTPUT -o vpn -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# dhcp
iptables -A OUTPUT -p udp --sport 68 --dport 67 -j ACCEPT # DHCP

# "I Agree"
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT # DNS/UDP
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT # DNS/TCP
iptables -A OUTPUT -p tcp --dport 80 -m owner --uid-owner your-userid -j ACCEPT

The last three rules are to allow you to get to the "I Agree" webpage. After you've clicked the "I accept" button and your VPN is up, you can get rid of them. Note that its possible for some stuff to leak out during that period, in particular DNS lookups. Avoiding that is much more difficult.

(Untested, I suggest having wireshark installed and running to debug if need be. I'm pretty sure its right, but am least confident about that DHCP line. It may not allow enough... If you don't get an IP address, that's what's wrong)