0

I use firewalld's direct rules to block all incoming and outgoing connections except for on a tun interface, making a kill switch for my VPN connections (similar to here).

I have since whitelisted specific VPN servers, and can connect to them directly.

Now I want to automate this process, and in doing so have to fetch statistical load data from my VPN provider's website.

I was thinking of calling something like

stats=$(curl provider.com/server/stats | *sed and grep extraction*)

but this requires DNS resolution, which is blocked at the moment. Is there a simple way, in shell scripting, to punch a hole in the firewall to temporarily only allow this one request?

I don't want to completely disable the firewall temporarily, possibly causing leakage.

Edit

Creating a proxy network or proxy machine feels like overkill. Is this truly such a complicated problem? I am seeking a solution simple in execution.

Improve this question

1 Answer 1

Reset to default
0

An idea is to set a local proxy and open the way out for it in the firewall. By default you wouldn't use it, but just keep it for special occasions.

Improve this answer
7
  • Do you mean another machine on my network acting as proxy?
    – palm tree
    Dec 16, 2019 at 15:19
  • @palmtree Either another machine on the network or a localhost proxy.
    – user147505
    Dec 16, 2019 at 15:20
  • Hmmm... That would work. Though, then there would be an "uncontrolled" egress.
    – palm tree
    Dec 16, 2019 at 15:23
  • @palmtree This could be controlled by a simple script (start up the proxy & open the firewall for it). But I can't think of a simple way to set up such a localhost proxy now... (I'd have to think.)
    – user147505
    Dec 16, 2019 at 15:26
  • Okay. Please let me know.
    – palm tree
    Dec 16, 2019 at 15:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .