7

I need some sort of "safeguard" for my VPN connection. If the connection drops, the machine shouldn't even reach the internet. (I can reach the machine by other means.)

Is it possible somehow?
If I remember correctly, there are some "safeguards" for Windows, but I never heard about such a solution for Linux. Not to mention for cli.

4
  • You need to verify your connection on the server or the client?
    – Tim
    Jul 27, 2012 at 12:51
  • Client. If the client drops the connection, the machine should try re-connecting or remain unreachable. But it shouldn't ever use the normal ISP connection.
    – Apache
    Jul 27, 2012 at 14:12
  • Think of it as a safebox. You live in a country where internet is not free. You create a passworded (encrypted) VM and you have openvpn inside that box. You can use SSH or even use the VM as your own environment. But: If openvpn goes down, the connection is public. | Now how do you solve that? :)
    – Apache
    Jul 27, 2012 at 14:36
  • Ps.: No I don't live in such a country, just an example about a use case.
    – Apache
    Jul 27, 2012 at 14:36

2 Answers 2

4

You can use the down directive in your client configuration to fire off a custom script when the connection drops. In the script, you could do several things for limiting public network connections. Here's my ideas:

  • Setup some iptables that only allow connections to the VPN server, all other connections dropped. Of course, do not forget to remove this restriction when the client comes back up
  • Modify the resolv.conf file to limit or turn off name resolution
  • Incorporate custom routing tables
1
  • Now that is neat.
    – Apache
    Jul 28, 2012 at 7:06
0

You can use a firewall for that. Disable all incoming and outgoing traffic by default. Allow outgoing traffic on the openvpn network interface. Allow the access to your vpn server from all interfaces (so you can connect to vpn).

If you can only use a host name to access the vpn server, you'll have to make these rules more permissive. Allow outgoing port 53 for name resolution and an outgoing vpn port.

I will put the configuration commands for ufw (uncomplicated firewall). These commands are based on askubuntu "UFW for OpenVPN" answer.

# Adapt this value to your config!
VPN_ADDRESS=...

ufw --force reset

ufw default deny incoming
ufw default deny outgoing

ufw allow out on tun0
ufw allow out to $VPN_ADDRESS

ufw enable

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .