Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to set up a Windows virtual machine where the only network access allowed is via a VPN connection. If the VPN connection fails, the VM should never be allowed access through my normal (ISP) connection. I've heard of software such as VPNLifeguard which checks periodically for the VPN being down, but this doesn't strike me as an elegant or secure solution.

I've read elsewhere that you can configure firewalls to block all traffic that's not going through your VPN's IP address, but what if your VPN IP is dynamic, or you can select multiple VPN servers to switch between? Then you'd have to change the firewall rules every time. Ditto for solutions which involve editing the routing tables.

Is there a solution which can take into account a VPN connection with a dynamic IP?

Since this is on a VM I can use either Windows XP or 7, and can get whatever firewall you recommend.

share|improve this question
What virtualization solution are you using? That's why you're getting downvotes. – AlexWebr Aug 24 '12 at 17:44

It would have been helpful to know how you are hosting the VMs, what hypervisor are you using?

Either way I'll assume its Hyper-V simply because you are talking Windows here. However, the same really will apply to VMware as well.

Remember a VM is a physical computer, its just hosted on top of another machine. With that in mind, can you prevent a physical machine from accessing the internet but still allow it to use a VPN connection? In some cases you can but its pretty difficult to setup and more of a pain to manage.

A VPN connection has to be carried over some sort of internet connection so your question doesn't make a whole lot of sense. You must have an established internet connection before your VPN tunnel can then establish itself.

So to answer your overall question, no you must provide internet access to the machine which would then have to initiate the VPN connection. There is no way to abstract this function out.

share|improve this answer
Thank you for your reply. I'm not quite sure why my question has received negative votes but I appreciate your help. I understand that in order to establish the VPN connection, my ISP connection must reach the machine. However, is there no way to force all the OS application traffic to not use the "raw" ISP connection and instead only connect through the VPN? – Robert Hawkins Aug 24 '12 at 17:30
Depending on the VPN package on the client you may be able to force all traffic over the VPN but until the VPN connection is established they would have free roam. Look for a flag such as force the use of the remote gateway. – Brent Pabst Aug 24 '12 at 19:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.