6

I'm using OpenVPN via command line to connect to my VPN on my current Linux distro since there is no GUI available (which had a killswitch checkbox).

My problem is, I can't find any way to add a killswitch or prevent fallback to my default connection when the VPN goes out.

Here is the command I currently use to connect:

openvpn --config /etc/openvpn/gateway.conf

Basically, I want to find a simple method to prevent my VPN to fallback to default connection if it goes out. I just want my connection to be dead until the VPN connection is restored.

gateway.conf

client
dev tun
proto udp
remote us-california.privateinternetaccess.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
tls-client
remote-cert-tls server
auth-user-pass /etc/openvpn/login.conf
comp-lzo
verb 1
reneg-sec 0
crl-verify /etc/openvpn/crl.pem


auth-nocache
script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh

Source files: https://aur.archlinux.org/packages/private-internet-access-vpn

  • Please would you edit your question to include the contents of your referenced gateway.conf file. Feel free to redact IP addresses and any other sensitive material, but please do it consistently – roaima Mar 13 '15 at 7:51
  • Just added that information. – Archery Mar 13 '15 at 8:14
1

You sould be able to do this by setting blackhole rules with higher metric: for each routing rule, you want to add a duplicate route with lower priority (higher metric) which will stay in place when the routed of the OpenVPN are torn down. This additional route is a blackhole, prohibit or unreachable route.

You should be able to to this with something like:

#!/bin/sh
set -e
ip route replace blackhole "$ifconfig_local/$ifconfig_netmask"

i=1
while true; do
  route_network_i="$(eval echo \$route_network_$i)"
  route_netmask_i="$(eval echo \$route_netmask_$i)"
  route_metric_i="$(eval echo \$route_metric_$i)"
  if [ -z "$route_network_i" ]; then
    break
  fi
  ip route replace blackhole "$route_network_i"/"$route_netmask_i" metric $(( $route_metric_i + 1 ))
  i=$(( $i + 1 )
done
0

When securing a VPN tunnel against leaks, its best to avoid mechanisms that the VPN client tries to manage itself. In most cases that means you should resort to iptables or nft instead of ip route as OpenVPN manipulates the latter in a variable fashion.

The following is an anti-leak method that can block all traffic except anything destined for tunnel devices and the OpenVPN link itself -- regardless of how routes are configured.


First, add a special group for use by the VPN client (you can choose another group name if you wish as long as its not already used by another user or program on your system):

sudo groupadd -r -f tunnel

Then the firewall rules which need to be run as root at each system startup or before the VPN starts:

#!/bin/sh
iptables -F OUTPUT
iptables -P OUTPUT DROP
iptables -A OUTPUT -p all -m owner --gid-owner tunnel -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

Notice that group ID 'tunnel' is a condition for net access, as is having a tunnel device 'tun+' as output. If your openvpn config uses tap devices instead, you can specify 'tap+' instead of 'tun+'.

Finally, you can run the VPN client under the special group ID:

sudo sg tunnel -c 'openvpn --config /etc/openvpn/gateway.conf --group tunnel'

The group name 'tunnel' is specified twice on the command line because we must ensure that the group ID for the openvpn process is set both during its initial startup and after the connection is established. If openvpn were being run from a systemd service instead of a command line or script, then the Group= assignment would be used instead of sg.

The above technique should protect you from leaks to clearnet at all times that the iptables rules are active, whether openvpn is running or not. This covers both data and DNS packets. And the policy of the OUTPUT chain can be used as a switch to effectively turn the rules on or off (using DROP or ACCEPT).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.