OpenVPN network kill switch

The_Guy · February 17, 2017, 12:58am

This is a weird issue nobody really answered on the internet.

How come the Open VPN client, the one open source trustworthy vpn client everyone uses, STILL does not come with a kill switch which automatically disables your network connections if it drops the vpn connection, and preferably also if the process is killed?

Other VPN clients, which are based on OpenVPN but are closed source, DO have a built in kill switch. Dafuq? I'm trying to move away from one of these closed source clients and use openvpn.

The thing is I don't trust Windows Firewall, nor do I want to be dependent on it (or on any firewall at all if I can avoid it) for my network kill switch. So what can I do?

Hammerhead_Corvette · February 17, 2017, 1:59am

I've seen so many discussions all with mixed results on this. Complaints of fail-over to normal connection if VPN crashes/disconnects, firewall rules to prevent fail-over ( configure a local firewall to disallow outbound traffic not originating from the OpenVPN process ) Find an OpenVPN client that supports running scripts on disconnection, Write a script which disables your ethernet interface on disconnection, I'm hoping someone here could shed some light ( if possible ) for this... But I believe that some clients have a feature like this built in. ( PrivateInternetAccess )

The_Guy · February 17, 2017, 2:19am

Yes. my current vpn client has a rudimentary killswitch. But it's not an open source client (albeit based on openVPN)

I guess you kinda have no choice but to implement SOME form of firewall. You either need to check each packet if it's about to go through the VPN or not (which the firewall can't know, right? because your vpn IP/location is not set in stone), or need to check if something happened to the VPN program/connection and if so, stop all network connections.

Also you need to start windows with all connections guaranteed forced off until vpn connects.

..And on Android it's the same, no killswitch. And on top of that you get the Android vpn protocol which is 100% unreliable for privacy as it can itself drop or leak in various situations.

The_Guy · February 17, 2017, 2:25am

I wonder if at least somebody figured it out reliably for Linux?

Hammerhead_Corvette · February 17, 2017, 2:32am

through scripts and the like it is possible. I do have some things I could post.. ( try at your own risk )

mythicalcreature · February 17, 2017, 4:20am

This is one possible implementation I've seen

github.com

dperson/openvpn-client/blob/master/openvpn.sh#L42-L53


iptables -F OUTPUT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -o tap0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A OUTPUT -d ${docker_network} -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -m owner --gid-owner vpn -j ACCEPT 2>/dev/null &&
iptables -A OUTPUT -p udp -m owner --gid-owner vpn -j ACCEPT || {
    iptables -A OUTPUT -p tcp -m tcp --dport 1194 -j ACCEPT
    iptables -A OUTPUT -p udp -m udp --dport 1194 -j ACCEPT; }
iptables -A OUTPUT -j DROP

This is a Docker project so some tweaking is needed, but the idea is:

Run Openvpn as specific group ("vpn" in this case)
Allow all traffic out of tun and tap interfaces
Allow all DNS traffic
Allow all traffic by the vpn group, or where destination port is 1194