Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im using IPredator VPN with openVPN and I want to make sure that if the connection is dropped, i wont submit data from the internet without the VPN. I heard that I could do that with iptables and a range. How can I do that? And how can I find out the ranges of IP's my VPN is assigning me?

share|improve this question
up vote 2 down vote accepted

Before you start your VPN take a copy of netstat -rn and ifconfig -a. Start your VPN, and the differences in those two commands will tell you what networks the VPN creates in terms of routes, and what IP you've been assigned to gain visibility of those networks. You will also need to get the IP of the server providing your VPN (or traffic to the VPN server will not reach it). I've also assumed your VPN server uses udp and not tcp, if it does use tcp you will need to update the 2nd rule to reflect that.

Once you have these you add OUTPUT rules in iptables to set what your host is allowed to see

 iptables -F OUTPUT
 iptables -I OUTPUT -d VPNSERVER -p udp -j ACCEPT -m comment --comment "Allow traffic to VPN SERVER"
 iptables -I OUTPUT -s VPNIP -d VPNNETWORK/CIDR -j ACCEPT -m comment --comment "Allow all traffic to VPN newtork"
 iptables -I OUTPUT -j DROP -m comment --comment "Drop all other traffic"

iptables -F OUTPUT flushes your existing rules, please be aware of that, but is required to do what your original question asked.

VPNSERVER would be the ip of your vpn server. VPNIP would be the IP the VPN assigned to you. VPNNETWORK/CIDR would be the routed network that appeared in netstat -rn something like

When debugging these rules it may be handy to log what is being dropped as some protocols may need some extra massaging:

 iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4 

That should be sufficient to stop traffic OUTBOUND from your PC to the internet, and only allow traffic to the VPN server and the network it provides.

The OP has pointed out that Arch Linux does not ship with a netstat or ifconfig. In which case the alternatives are:

ip addr show will show you interfaces and ip route show will show you what routes you have.

share|improve this answer
First of all thanks for your help. ifconfig and netstat appear not to exist in Arch. Also iptables -X OUTPUT returns me a "iptables: Invalid argument. Run `dmesg' for more information. " – Paul Woitaschek Aug 24 '13 at 17:29
I've updated my answer, iptables should also be using -F not -X my bad! :) – Drav Sloan Aug 24 '13 at 20:00
It seems the IP of the VPN is changing from time to time. How can I find out, which ones are used? – Paul Woitaschek Sep 6 '13 at 18:39
Actually, -I adds the rule to the top of the stack (making it the first rule), while -A adds them to the bottom. Therefore, these commands are in inverse order (iptables -F should be followed by iptables -I OUTPUT -j DROP, then others) – Anuj Gupta Apr 30 '14 at 19:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.