7

I need some sort of "safeguard" for my VPN connection. If the connection drops, the machine shouldn't even reach the internet. (I can reach the machine by other means.)

Is it possible somehow?
If I remember correctly, there are some "safeguards" for Windows, but I never heard about such a solution for Linux. Not to mention for cli.

  • You need to verify your connection on the server or the client? – Tim Jul 27 '12 at 12:51
  • Client. If the client drops the connection, the machine should try re-connecting or remain unreachable. But it shouldn't ever use the normal ISP connection. – user10570 Jul 27 '12 at 14:12
  • Think of it as a safebox. You live in a country where internet is not free. You create a passworded (encrypted) VM and you have openvpn inside that box. You can use SSH or even use the VM as your own environment. But: If openvpn goes down, the connection is public. | Now how do you solve that? :) – user10570 Jul 27 '12 at 14:36
  • Ps.: No I don't live in such a country, just an example about a use case. – user10570 Jul 27 '12 at 14:36
4

You can use the down directive in your client configuration to fire off a custom script when the connection drops. In the script, you could do several things for limiting public network connections. Here's my ideas:

  • Setup some iptables that only allow connections to the VPN server, all other connections dropped. Of course, do not forget to remove this restriction when the client comes back up
  • Modify the resolv.conf file to limit or turn off name resolution
  • Incorporate custom routing tables
  • Now that is neat. – user10570 Jul 28 '12 at 7:06
0

You can use a firewall for that. Disable all incoming and outgoing traffic by default. Allow outgoing traffic on the openvpn network interface. Allow the access to your vpn server from all interfaces (so you can connect to vpn).

If you can only use a host name to access the vpn server, you'll have to make these rules more permissive. Allow outgoing port 53 for name resolution and an outgoing vpn port.

I will put the configuration commands for ufw (uncomplicated firewall). These commands are based on askubuntu "UFW for OpenVPN" answer.

# Adapt this value to your config!
VPN_ADDRESS=...

ufw --force reset

ufw default deny incoming
ufw default deny outgoing

ufw allow out on tun0
ufw allow out to $VPN_ADDRESS

ufw enable

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.