I have a laptop running Ubuntu 12.04 (still waiting for the 14.04.1)
I have set an openvpn network with the network manager.
If the vpn drops the network manager set back its route through the available network interface and the packet are routed through the other networks.
I there a simple way to avoid that ?

After some testing :
A VPN gateway can have many different addresses, you can check that using command

nslookup VPN_gateway_name

If it is the case, each new request to establish a VPN will use randomly one IP in the address pool. To not change the IP filter at each new connection, one can use the DNS name of the gateway; iptables will set one rule for each IP.

second rule will looks like

 sudo iptables -A OUTPUT -d your_vpn_gateway_dns_name -j ACCEPT

Iptables will do this

sudo iptables -A OUTPUT -o tun0 -j ACCEPT
sudo iptables -A OUTPUT -d your_vpn_gateway_ip -j ACCEPT
sudo iptables -A OUTPUT -d -j ACCEPT
sudo iptables -A OUTPUT -j REJECT

Assuming all output is going to the VPN. Note: Depending on your network, you traffic can be monitored via various tools such as wireshark, sort, etc.

  • thank you, I will use that if there is no simpler way, I was hoping there was some special option to not fall back to the previous network configuration. – Emmanuel Jul 15 '14 at 18:13
  • You can combine the first 2 rules if you wish iptables -A OUTPUT -o tun0 -d your_vpn_ip -j ACCEPT As it is, the packet match the first rule, so the second rule will not be used with your tun0 . – Panther Jul 17 '14 at 15:54
  • Actually rule 1 is for all the the VPN usage, rule 2 is for the tunnel itself, its packets go out through eth0 or wlan0. – Emmanuel Jul 17 '14 at 18:28

You could also solve this problem easily with udev since a tun interface is removed when vpn connection drops. this rule will just disconnect from your wifi ap whenever a vpn connection is terminated, so you gotta reconnect manually again: Create a file /etc/udev/rules.d/81-vpn-firewall.rules, and add this rule to it:

KERNEL=="tun0", ACTION=="remove", RUN+="/usr/bin/nmcli dev disconnect iface wlan0"

Finally restart udev:

sudo service udev restart

  • Thank you, I will adopt it as a second security to backup the firewall. It remains the risk that some packets leaks while the command is executed or that the command fails for some reason. For instance on high load or high memory pressure, the nmcli execution may be delayed of after an os update the nmcli is no more working. – Emmanuel Nov 7 '14 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.