I want to block all non-vpn traffic, for which I have a script with iptables rules that works fine. The problem is that I can only set those rules after being connected to the vpn (if I do it before, I can't connect to the vpn). The connection to the vpn happens when I login, because that's how the network manager works (each user can handle its own connections).

So how do I auto-execute a script as root, after I'm logged in and connected to the vpn? I might need this even for non sudoer users

  • Which VPN? How is the VPN managed? – mgorven Jun 22 '12 at 22:40
  • @mgorven I'm using openvpn and network-manager (nmcli). I think I will have to use a C binary with setuid to activate/deactivate iptables on startup. Not sure how to wait for the non-vpn connection to be ready though. – HappyDeveloper Jun 22 '12 at 23:44

you don't need iptables, but just change the default gateway. for openvpn, you can use "redirect-gateway def1" on client side, or push .... on the server side. if the above doesn't meet your need, you can also use "up" scripts in your openvpn config file.

script-security 2
up /path/to/your/script
  • I need iptables to make sure that there is no way out of my pc, other than the vpn tunnel. If I don't do this, something can go wrong and my real ip will be revealed, or data may be sent in cleartext. – HappyDeveloper Jun 23 '12 at 2:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.