I recently started using Nordvpn which advertises that it has a kill Switch feature that supposedly will kill all traffic if it loses the VPN connection. After some experimentation I found that the kill switch feature they supply doesn't work. So I went online and found several very similar kill switch scripts that appear to work, but it left me with more questions.
When I enact the script,
sudo ufw reset
sudo ufw default deny incoming
sudo ufw default deny outgoing
sudo ufw allow out on tun0 from any to any
sudo ufw enable
And look at my interfaces (in this example, using ip), I get the following output:
snip (removed loopback and eth for clarity)
3: wlp3s0: mtu 1500 qdisc mq state UP mode D$
link/ether 60:67:20:02:1f:b4 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast 11013898449 8943422 0 0 0 0
TX: bytes packets errors dropped carrier collsns 424864927 3330381 0 0 0 0
8: tun0: mtu 1500 qdisc fq_codel sta$ link/none
RX: bytes packets errors dropped overrun mcast 2448944 2909 0 0 0 0
TX: bytes packets errors dropped carrier collsns 315943 2381 0 0 0 0
I can see that I am still seeing traffic on wlp3s0. Is this to be expected? My thinking is that I would only see RX and TX on Tun0.
Having said that, when I test to see what happens when I drop the VPN - all traffic does stop - I am just very curious about what's going on with the wlp3s0 traffic. Can anyone give me a hint?