I have a VPN that I connect to via domain name, not via IP. (with OpenVPN, in Debian)
VPN's IP is dynamic, can change any moment, by design, out of my control. I want my machine's only communication with the internet, on everything except
tun0, to be
my.vpn.domain.com (via OpenDNS I guess) and nothing else. No leaks.
Right now I manually check for a valid vpn IP from the domain, and I use iptables / ufw to make the appropriate limitations. But I need a fully automatic (re)connecting solution.
I think the only option is to use an Application Layer (layer 7) solution, since iptables (layer 3+4) can't deal with domain resolution. It seems I want something that uses OpenDNS to automatically get the IP for the VPN while also having no other leaks like mentioned up top.
How can we achieve this? I can do this with PFSense, but I can't use PFSense.