Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How can I set-up a VPN so I loose connection to the Internet if it goes down? I use Ubuntu and have used the network-dialog to use a VPN; but if the VPN goes down, it just switches to the non-VPN (eth0) connection. I would like to "disconnect" from the Internet (only allow connection by VPN) if VPN goes down. Obviously the VPN itself must be directly connected, but everything else should go through VPN.

Alternatively, is it possible to set-up a virtual-computer (I'm semi-comfortable with VirtualBox) in this way? Or perhaps a way to limit Internet-access to VPN-only for just certain programs?

I guess routing or iptables would be the obvious way to do it, but I really don't know where to start. I've seen some tutorials for setting-up a VPN-connection or ssh-tunnel by manipulating routing, but I don't know if they would work for this.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Netfilter(iptables) will do what you need. There are plenty of tutorials about it.

a few commands to execute :

 #the default rule will be to drop everything that leaves your computer
iptables -P OUTPUT DROP
iptables -t filter -A OUTPUT -o lo -j ACCEPT
iptables -t filter -A OUTPUT -o tun0(your vpn interface) -j ACCEPT
iptables -t filter -A OUTPUT -o eth0(your real interface) -p udp(or tcp) --dport 9999(the port, the vpn server listens to) -j ACCEPT

If you put it into a script, that you launch everytime you need it, it will drop everything that would leave your computer, exception made for your vpn.

pay attention that plenty of services will be unjoinable after (like dns, dhcp,...).

share|improve this answer

Set up routing such that the only route on eth0 is that to the VPN endpoint. Since there will be no route to the Internet without the VPN up, no programs will be able to connect.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.