I'm running a linux debian x64. OpenVPN is running and configured.

Now I want to disable the internet connection whenever my vpn isn't running or the connection broke up.

You know what I mean?

VPN working -> internet connection

VPN not working -> no internet connection

Is it possible to solve this within iptables or what should be the best way?

  • When OpenVPN is up, do you normally route all your internet traffic over it?
    – MadHatter
    Commented Apr 24, 2017 at 8:09
  • Yes, but i want to block any traffic if it isn't running or down.
    – vP3nguin
    Commented Apr 24, 2017 at 8:23

1 Answer 1


You normally run all your internet traffic over OpenVPN when it's up, and presumably wish not to have this leak over the plaintext internet when OpenVPN falls over. As such, this is fairly easy: simply forbid any traffic to leave your regular ethernet interface (which I assume here is eth0) unless it's either OpenVPN traffic (which I assume here is UDP/1194, modify appropriately for TCP OpenVPN), or infrastructurally necessary (DNS, ICMP):

iptables -A OUTPUT -o eth0 -p udp --dport 1194 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp  -j ACCEPT
iptables -A OUTPUT -o eth0 -j DROP

I know that not all ICMP is needed, but I don't personally find harm in allowing PING requests and PONG responses out; modify the rules above if you do. iptables rules are order-sensitive, so if you already have rules in your OUTPUT chain, then getting these in the right place is something you will need to have a care to do.

  • dns requests will work without a vpn connection in your config, right? can you please explain why this have to be done? And additionally I can block incoming traffic as well or why not?
    – vP3nguin
    Commented Apr 24, 2017 at 8:31
  • Because all the OpenVPN configs that I write specify the remote end by FQDN with eg remote vpn.example.com, so I don't have to revisit hundreds of clients if and when we move site or change ISP. To start OpenVPN thus requires a DNS lookup. If your remote endpoint is specified by IP address then you won't need to bother with that. As for incoming traffic, I assume you have a healthy blocklist already, I don't personally see a need to modify it for this particular scenario. But it's your setup!
    – MadHatter
    Commented Apr 24, 2017 at 8:33
  • I'm using an ipv4 address for remote end, so I can ignore the dns rule, right?
    – vP3nguin
    Commented Apr 24, 2017 at 8:35
  • Yes, that is exactly what I said.
    – MadHatter
    Commented Apr 24, 2017 at 8:35
  • Sorry my english isn't the best :D I will check it out and experiment a little bit with some rules.
    – vP3nguin
    Commented Apr 24, 2017 at 8:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .