Trying to write the perfect VPN kill-switch bash script - have a question about wlp3s0 traffic. Ubuntu 18.04

Question

I recently started using Nordvpn which advertises that it has a kill Switch feature that supposedly will kill all traffic if it loses the VPN connection. After some experimentation I found that the kill switch feature they supply doesn't work. So I went online and found several very similar kill switch scripts that appear to work, but it left me with more questions.

When I enact the script,

sudo ufw reset

sudo ufw default deny incoming

sudo ufw default deny outgoing

sudo ufw allow out on tun0 from any to any

sudo ufw enable

And look at my interfaces (in this example, using ip), I get the following output:

snip (removed loopback and eth for clarity)

3: wlp3s0: mtu 1500 qdisc mq state UP mode D$

link/ether 60:67:20:02:1f:b4 brd ff:ff:ff:ff:ff:ff

RX: bytes packets errors dropped overrun mcast 11013898449 8943422 0 0 0 0

TX: bytes packets errors dropped carrier collsns 424864927 3330381 0 0 0 0

8: tun0: mtu 1500 qdisc fq_codel sta$ link/none

RX: bytes packets errors dropped overrun mcast 2448944 2909 0 0 0 0

TX: bytes packets errors dropped carrier collsns 315943 2381 0 0 0 0

I can see that I am still seeing traffic on wlp3s0. Is this to be expected? My thinking is that I would only see RX and TX on Tun0.

Having said that, when I test to see what happens when I drop the VPN - all traffic does stop - I am just very curious about what's going on with the wlp3s0 traffic. Can anyone give me a hint?

Answer 1

The wlp3s0 is your physical adapter, the tun0 is created on top of this adapter. The reason you see traffic on wlp3s0 is because tun0 is tunneling traffic over wlp3s0. The packets are being encrypted when they reach tun0 and are sent via wlp3s0 to the Openvpn server.

If you stop traffic via iptables on the wlp3s0 you will loose your vpn tun0 connection as well.