Is it possible to set-up a VPN in such a way that I disconnect from the Internet if it goes down?

Question

How can I set-up a VPN so I loose connection to the Internet if it goes down? I use Ubuntu and have used the network-dialog to use a VPN; but if the VPN goes down, it just switches to the non-VPN (eth0) connection. I would like to "disconnect" from the Internet (only allow connection by VPN) if VPN goes down. Obviously the VPN itself must be directly connected, but everything else should go through VPN.

Alternatively, is it possible to set-up a virtual-computer (I'm semi-comfortable with VirtualBox) in this way? Or perhaps a way to limit Internet-access to VPN-only for just certain programs?

I guess routing or iptables would be the obvious way to do it, but I really don't know where to start. I've seen some tutorials for setting-up a VPN-connection or ssh-tunnel by manipulating routing, but I don't know if they would work for this.

Answer 1

Netfilter(iptables) will do what you need. There are plenty of tutorials about it.

a few commands to execute :

 #the default rule will be to drop everything that leaves your computer
iptables -P OUTPUT DROP
iptables -t filter -A OUTPUT -o lo -j ACCEPT
iptables -t filter -A OUTPUT -o tun0(your vpn interface) -j ACCEPT
iptables -t filter -A OUTPUT -o eth0(your real interface) -p udp(or tcp) --dport 9999(the port, the vpn server listens to) -j ACCEPT

If you put it into a script, that you launch everytime you need it, it will drop everything that would leave your computer, exception made for your vpn.

pay attention that plenty of services will be unjoinable after (like dns, dhcp,...).

Answer 2

Set up routing such that the only route on eth0 is that to the VPN endpoint. Since there will be no route to the Internet without the VPN up, no programs will be able to connect.