Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I edited iptables so that when the VPN service is disconnected, no program will access the internet.

Well, I did an experiment. I disconnected the VPN service manually and immediately did a ping by issuing the following command:

sudo ping www.yahoo.com

Below are the results:

PING ds-any-fp3-real.wa1.b.yahoo.com (206.190.36.45) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- ds-any-fp3-real.wa1.b.yahoo.com ping statistics ---
8 packets transmitted, 0 received, 100% packet loss, time 7056ms

Was any data including geolocation information sent out from my computer and received by the destination party during the ping session?

share|improve this question
    
Try to ping your gateway, let us know the results please. –  RGS Jun 2 '13 at 15:07
    
What makes you think data is being sent? –  Eric Carvalho Jun 2 '13 at 15:19
    
www.yahoo.com was resolved to an IP, so unless your DNS server is local, information has been sent out. –  Alaa Jun 2 '13 at 15:23
    
@Alaa Maybe it's in the DNS cache. n00b, can you post the iptables rules? –  Eric Carvalho Jun 2 '13 at 15:26
2  
Come to think of it though, what is your aim? Is it to block internet access, or to block network access (including LAN)? Because you couldn't ping your gateway either, so the ping program all together is denied everything. And since your computer did find the IP of yahoo, it means that you didn't block DNS. Which brings us to Eric's answer. –  Alaa Jun 3 '13 at 5:26
show 9 more comments

1 Answer

I think you're worried about the 8 packets transmitted message.

The ping application generates packets and submits them to the kernel for processing. Those are the "transmitted" packets reported in ping statistics. When packets enter the iptables' chains they can be accepted, dropped or rejected.

Ping says sendmsg: Operation not permitted because packets sent by the application were not accepted. So the answer is no, packets sent by ping didn't leave your computer.

But, as said by Alaa, you pinged www.yahoo.com and the name was successfully resolved to an address (206.190.36.45). This only happens if your computer sends a DNS query and receives a reply or if the name is in the DNS cache, which shouldn't happen by default (thanks @Alaa).

Are you sure all the traffic is blocked if VPN is disconnected? Maybe you didn't block DNS. You should only accept output traffic destined to your VPN gateway.

share|improve this answer
2  
Yes, @n00b, it seems that you haven't blocked DNS. If you want to test this, do nslookup website.com, where website.com is a website you've never visited before; you can use abcdef.com. If it returns results, then you haven't blocked DNS. But then again, in my comments on your question, what is your aim? Block internet access, but not local network access? Because your computer might've went to the router for the DNS query. I'll continue in the chat. –  Alaa Jun 3 '13 at 5:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.