I'd like to use a VPN when on public wifi for security. In order to establish my OpenVPN tunnel I need a working network connection. When I connect to a public wifi access point there is a window of time after connecting but before my VPN client is launched, connects and updates the route table, during which traffic from my system travels unencrypted over public wifi.

How can I cause wifi to pass no traffic except traffic destined for my OpenVPN server during that window of time?

Extra credit : Is there a way to whitelist wifi networks as trusted (like my home or work wifi) such that all traffic is allowed as I won't be using a VPN?

  • Interesting question. However, I don't think its feasible (even with iptable) as there's plenty of services, apps... etc running on various protocols/ports... etc. And they'll fire-up right away when you establish and internet connection. Well, that's my opinion but I might be wrong. Something to think of. – AzkerM May 4 '17 at 19:31
  • You can white-list your trusted network based on mac address of router with iptables. sudo iptables -A INPUT -m mac --mac-source <mac_address_of_you_router> -j ACCEPT and drop anything from different mac address on input with command sudo iptables -A INPUT -m mac ! --mac-source <mac_address_of_you_router> -j DROP. But this command will DROP input from public wifi. One more thing. Like you say you must allow some traffic when you wish connect on public wifi.If not, you cannot connect to VPN. If we cat traffic based on mac you will not get ip address from DHCP from public wifi router – 2707974 May 4 '17 at 21:39

Most vpn services provide a client you can use for their service. These clients usually block everything on your computer from accessing the Internet outside of the vpn. When you start up your computer, simply disconnect wifi or eth and connect after the client has started up. Once started, everything is blocked.

You should look for a service that publishes the source code of their client so you can check what exactly it is doing.


Maybe I have solution for you.

Create script in /etc/NetworkManager/dispatcher.d/vpn-up

#! /bin/bash


activ_con=$(nmcli con status | grep "${REQUIRED_CONNECTION_NAME}")
activ_vpn=$(nmcli con status | grep "${VPN_CONNECTION_NAME}")
if [ "${activ_con}" -a ! "${activ_vpn}" ];
    nmcli con up id "${VPN_CONNECTION_NAME}"

Witch mean, if is not connected to REQUIRED_CONNECTION_NAME aka home wifi dispecher will connect to vpn.

This will work only if you use NM for VPN connection. If not use NM for vpn connection, change in script nmcli con up id "${VPN_CONNECTION_NAME}" with you command for vpn connection to run.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.