Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to estable a openVPN connection on one of my computers. But I want to make sure that the connection is secure by filtering everything except for openVPN. Therefore openVPN will be the only way to access the internet.

What would be the best way to do this? iptables?

Secure in the way that if there is no openVPN connection, there is no access to the internet.

share|improve this question

closed as off topic by Michael Hampton, joeqwerty, Zoredache, Wesley, Jacob Apr 2 '13 at 18:39

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Why by mac address? Why not just block everything through your firewall except connections to the OpenVPN server? – Zoredache Apr 2 '13 at 18:13
for example, this would be for a torrent box. my ISP is anti torrent, its easy to get a notification within minutes if torrenting without VPN and end up paying a fine. So I suppose this is best done on the router side? or it could be done client side, but if I ever format I'd have to reconfigure. – trizuken Apr 2 '13 at 20:02
You could always simply remove your default gateway on the client machine, and add a static route for the VPM server address only. – Zoredache Apr 2 '13 at 20:21

VPN connections are secure "by definition". Otherwise you would not call it a VPN. Security is reached by crypto keys. Looking at MAC addresses in this context does not make sense.

It is not clear what the connection shall look like but I assume that no routing is intended. So you need at least four rules in your firewall (for the physical interface, say eth0):

iptables -P OUTPUT DROP
iptables -A OUTPUT -o eth0 -d $OPENVPN_DESTIP -j ACCEPT
iptables -P INPUT DROP
iptables -A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Furthermore you need rules for the VPN interface, say tun0:

iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A INPUT -i tun0 -m conntrack --ctstate ESTABLISHED -j ACCEPT
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.