On Ubuntu 12.04 - actually Kubuntu, but I am using NetworkManager, so the configuration should be the same - I have configured a few VPN connections.

Now, if I have a long-running up- or download, how can I ensure that all network traffic is stopped immediately and unconditionally if the VPN connection breaks off?

What I am looking for is some method of getting notified (I don't want to poll!) of the change. The rest (e.g. inserting netfilter rules) I can handle myself. I just need to find out how to get notified about a change to an established connection.

In case it matters, the configuration I am using is based on tun0. If other details are required, let me know in a comment and I'll add them to the question.

What I have tried so far:

  • configure the main LAN connection (this is inside a VM, so there is only a LAN connection) to be manual
  • configure the VPN to be automatic

then I figured that this isn't the route I want to take anyway, because I want to start my script/program to get notified only whenever I activate the VPN. I am not running on VPN all the time, but most of the time.

So basically I need to register for some notification as soon as a particular VPN connection is established and then get notified if something happens to it in order to tear down the main connection automatically in response.


NetworkManager should be able to do this for you. From the man page:

Information about networking is exported via a D-Bus interface to any interested application, providing a rich API with which to inspect and control network settings and operation.

NetworkManager will execute scripts in the /etc/NetworkManager/dispatcher.d directory in alphabetical order in response to network events.


Each script receives two arguments, the first being the interface name of the device just activated, and second an action.



vpn-up: A VPN connection has been activated. The environment contains the connection UUID in the variable CONNECTION_UUID.

vpn-down: A VPN connection has been deactivated.

So it looks like you have two routes: tie into D-Bus to listen for events and act upon them, or drop some scripts into /etc/NetworkManager/dispatcher.d/. The latter seems the path of least resistance.

  • Excellent, looks like what I was looking for. Thanks. – 0xC0000022L Jun 23 '13 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.