Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Goal: Ensure all traffic is forced over VPN tunnel from all network interfaces (wlan0,rmnet0,rmnet1), that is all traffic is dropped when not connected to VPN. In other words, Internet traffic should not be allowed, and only traffic over the VPN is acceptable.

So far... Android Device with iptables binary, wlan & 3g connection VPN gateway @ (not real address).

iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -j DROP

iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o tun0 -m conntrack --ctstate NEW -j ACCEPT
iptables -A OUTPUT -d -m conntrack --ctstate NEW -j ACCEPT
iptables -A OUTPUT -j DROP


Traffic appears to be blocked - but so too is connection to VPN.

Any ideas? Appreciate this is only mobile data rmnet0 interface and doesn't have WiFi in here yet.

share|improve this question
up vote 0 down vote accepted

I wouldn't use conntrack in this scenario but a much simpler set

iptables -A INPUT  -i tun0 -j ACCEPT
iptables -A INPUT  -s -j ACCEPT
iptables -A OUTPUT -i tun0 -j ACCEPT
iptables -A OUTPUT -d -j ACCEPT

No need for any connection tracking. You also don't need the DROP rules at the end by the way, the -P ... DROP takes care of that.

You'll also want to make sure that you use the IP of the vpn server in your config, otherwise you'll have to whitelist DNS too:

iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT  -p udp --sport 53 -j ACCEPT
share|improve this answer
Thanks for the help - a quick question though, and kind of the reason i was being led down the conntrack route... Will i be able to get a DHCP IP address on the WLAN interface & IP Address on the 3G connection with this? The reason i ask is i can only bring the IPtables config up on boot, as anything else needs root... so wlan & mobile data etc may be enabled post boot, but i still need the rules to apply. – diagonalbatman Jan 28 '13 at 18:59
Good catch! Yes, you'll have to whitelist dhcp traffic (UDP 67 to server, 68 from server) too. – Dennis Kaarsemaker Jan 28 '13 at 19:01
Thanks - does 3G use DHCP too? – diagonalbatman Jan 28 '13 at 19:04
No, ip addresses are negotiated over PPP there, I believe. I'm not too familiar with 3g though, so fire up wireshark and make a 3g connection. You'll see what happens :) – Dennis Kaarsemaker Jan 28 '13 at 19:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.