Before you start your VPN take a copy of
netstat -rn and
ifconfig -a. Start your VPN, and the differences in those two commands will tell you what networks the VPN creates in terms of routes, and what IP you've been assigned to gain visibility of those networks. You will also need to get the IP of the server providing your VPN (or traffic to the VPN server will not reach it). I've also assumed your VPN server uses
udp and not
tcp, if it does use
tcp you will need to update the 2nd rule to reflect that.
Once you have these you add
OUTPUT rules in iptables to set what your host is allowed to see
iptables -F OUTPUT
iptables -I OUTPUT -d VPNSERVER -p udp -j ACCEPT -m comment --comment "Allow traffic to VPN SERVER"
iptables -I OUTPUT -s VPNIP -d VPNNETWORK/CIDR -j ACCEPT -m comment --comment "Allow all traffic to VPN newtork"
iptables -I OUTPUT -j DROP -m comment --comment "Drop all other traffic"
iptables -F OUTPUT flushes your existing rules, please be aware of that, but is required to do what your original question asked.
VPNSERVER would be the ip of your vpn server.
VPNIP would be the IP the VPN assigned to you.
VPNNETWORK/CIDR would be the routed network that appeared in
netstat -rn something
When debugging these rules it may be handy to log what is being dropped as some protocols may need some extra massaging:
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
That should be sufficient to stop traffic
OUTBOUND from your PC to the internet, and only allow traffic to the VPN server and the network it provides.
The OP has pointed out that Arch Linux does not ship with a
ifconfig. In which case the alternatives are:
ip addr show will show you interfaces and
ip route show will show you what routes you have.