Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I want to block all non-vpn traffic, for which I have a script with iptables rules that works fine. The problem is that I can only set those rules after being connected to the vpn (if I do it before, I can't connect to the vpn). The connection to the vpn happens when I login, because that's how the network manager works (each user can handle its own connections).

So how do I auto-execute a script as root, after I'm logged in and connected to the vpn? I might need this even for non sudoer users

share|improve this question
Which VPN? How is the VPN managed? – mgorven Jun 22 '12 at 22:40
@mgorven I'm using openvpn and network-manager (nmcli). I think I will have to use a C binary with setuid to activate/deactivate iptables on startup. Not sure how to wait for the non-vpn connection to be ready though. – HappyDeveloper Jun 22 '12 at 23:44

1 Answer

up vote 0 down vote

you don't need iptables, but just change the default gateway. for openvpn, you can use "redirect-gateway def1" on client side, or push .... on the server side. if the above doesn't meet your need, you can also use "up" scripts in your openvpn config file.

script-security 2
up /path/to/your/script
share|improve this answer
I need iptables to make sure that there is no way out of my pc, other than the vpn tunnel. If I don't do this, something can go wrong and my real ip will be revealed, or data may be sent in cleartext. – HappyDeveloper Jun 23 '12 at 2:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.