I use firewalld's direct rules to block all incoming and outgoing connections except for on a tun interface, making a kill switch for my VPN connections (similar to here).

I have since whitelisted specific VPN servers, and can connect to them directly.

Now I want to automate this process, and in doing so have to fetch statistical load data from my VPN provider's website.

I was thinking of calling something like

stats=$(curl provider.com/server/stats | *sed and grep extraction*)

but this requires DNS resolution, which is blocked at the moment. Is there a simple way, in shell scripting, to punch a hole in the firewall to temporarily only allow this one request?

I don't want to completely disable the firewall temporarily, possibly causing leakage.


Creating a proxy network or proxy machine feels like overkill. Is this truly such a complicated problem? I am seeking a solution simple in execution.


An idea is to set a local proxy and open the way out for it in the firewall. By default you wouldn't use it, but just keep it for special occasions.

| improve this answer | |
  • Do you mean another machine on my network acting as proxy? – palm tree Dec 16 '19 at 15:19
  • @palmtree Either another machine on the network or a localhost proxy. – user147505 Dec 16 '19 at 15:20
  • Hmmm... That would work. Though, then there would be an "uncontrolled" egress. – palm tree Dec 16 '19 at 15:23
  • @palmtree This could be controlled by a simple script (start up the proxy & open the firewall for it). But I can't think of a simple way to set up such a localhost proxy now... (I'd have to think.) – user147505 Dec 16 '19 at 15:26
  • Okay. Please let me know. – palm tree Dec 16 '19 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.