I've commonly seen people use the postup and predown commands inside wireguard configs to implement a "kill switch", blocking any connections that don't go through Wireguard. Here's an example. Reading up on what postup does, I found on this doc:

Optionally run a command after the interface is brought up.

So two questions based on this:

  1. does this prevent leaks while the computer is starting up? Is there some time where the system may be making network requests (e.g. fetching updates) before wireguard brings up the interface?

  2. does this prevent leaks if you switch between different wireguard configs?


1 Answer 1


You are correct that a "kill switch" implemented with PostUp/PreDown scripts will apply only while the WireGuard interface is up, and won't prevent "leaks" while the computer is starting up or switching between WireGuard interfaces.

If it's critical to you to prevent traffic from leaving your computer other than through your WireGuard interfaces, you should configure your computer's firewall to do the following:

  1. Block all outbound traffic by default
  2. Allow outbound traffic to your external WireGuard endpoints (IP address + UDP port)
  3. Allow local traffic for DHCP or whatever LAN services you need

During you computer's startup process, there will be a small amount of time between which the networking subsystem is operational, and the firewall is up. If you want to prevent leaks from occuring during that time period, configure your physical network interfaces to not start up automatically; start them manually once your computer has finished booting (or for a wired network interface, simply unplug it while the computer is starting up).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .