Goal: Ensure all traffic is forced over VPN tunnel from all network interfaces (wlan0,rmnet0,rmnet1), that is all traffic is dropped when not connected to VPN. In other words, Internet traffic should not be allowed, and only traffic over the VPN is acceptable.

So far... Android Device with iptables binary, wlan & 3g connection VPN gateway @ (not real address).

iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -j DROP

iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o tun0 -m conntrack --ctstate NEW -j ACCEPT
iptables -A OUTPUT -d -m conntrack --ctstate NEW -j ACCEPT
iptables -A OUTPUT -j DROP


Traffic appears to be blocked - but so too is connection to VPN.

Any ideas? Appreciate this is only mobile data rmnet0 interface and doesn't have WiFi in here yet.


I wouldn't use conntrack in this scenario but a much simpler set

iptables -A INPUT  -i tun0 -j ACCEPT
iptables -A INPUT  -s -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A OUTPUT -d -j ACCEPT

No need for any connection tracking. You also don't need the DROP rules at the end, by the way, the -P ... DROP takes care of that.

You'll also want to make sure that you use the IP of the VPN server in your config, otherwise, you'll have to whitelist DNS too:

iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT  -p udp --sport 53 -j ACCEPT
|improve this answer|||||
  • Thanks for the help - a quick question though, and kind of the reason i was being led down the conntrack route... Will i be able to get a DHCP IP address on the WLAN interface & IP Address on the 3G connection with this? The reason i ask is i can only bring the IPtables config up on boot, as anything else needs root... so wlan & mobile data etc may be enabled post boot, but i still need the rules to apply. – diagonalbatman Jan 28 '13 at 18:59
  • Good catch! Yes, you'll have to whitelist dhcp traffic (UDP 67 to server, 68 from server) too. – Dennis Kaarsemaker Jan 28 '13 at 19:01
  • Thanks - does 3G use DHCP too? – diagonalbatman Jan 28 '13 at 19:04
  • No, ip addresses are negotiated over PPP there, I believe. I'm not too familiar with 3g though, so fire up wireshark and make a 3g connection. You'll see what happens :) – Dennis Kaarsemaker Jan 28 '13 at 19:06
  • I know this is the accepted answer, but could you post your final string of iptables commands? – Fmstrat Jul 9 '18 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.