RaspBMC and OpenVPN: block traffic except VPN with IPTables

Question

Current status: OpenVPN is up and runnning, ifconfig shows eth0, lo, tun0.

To be achieved: Temporarily blocking all traffic via calling a bash script except all traffic in home network and all traffic over VPN. And a second script, that restores the RaspBMC defaults (without reboot).

After some research, I believe this could be achieved with IPTables. Please advice, if this is not the way to go.

Now the details - for the sake of completeness (and maybe to catch some mistakes I might have made) the OpenVPN configuration file and the output on the Terminal after start:

OpenVPN is on tun, udp, port 53.

Output of ifconfig -s:

Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0       1500 0      3103      0      0 0          1949      0      0      0 BMRU
lo        65536 0         8      0      0 0             8      0      0      0 LRU
tun0       1500 0        11      0      0 0            11      0      0      0 MOPRU

Output of iptables -L (these should be default RaspBMC as I did not change anything)

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  10.0.1.0/24          anywhere
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Finally, I am overwhelmed with iptables-configuration, even after hours of reading. And I am worried about overlooking something which keeps me running without VPN.

What I really want to achieve: if I start my bash script "safe on", I want that only local traffic and traffic via VPN is allowed. If VPN disconnects, all programms should loose their connection just as if the internet connection itself would be offline (and ideally resume, when VPN comes online again). And with "safe off" I want to return to the default settings with all possibilities (with or without connected VPN). Ideally, local access should be always allowed.

I would deeply appreciate any tips!

Answer 1

example is for a PIA VPN

#Allow loopback device (internal communication)
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#Allow all local traffic.
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -d 192.168.1.0/24 -j ACCEPT

#Allow VPN establishment
iptables -A OUTPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -p udp --sport 1194 -j ACCEPT

#Allow traffic to uk and hk PIA server to reconnect VPN in case of failure
iptables -A INPUT -s uk-london.privateinternetaccess.com -j ACCEPT
iptables -A OUTPUT -d uk-london.privateinternetaccess.com -j ACCEPT
iptables -A INPUT -s  hk.privateinternetaccess.com -j ACCEPT
iptables -A OUTPUT -d hk.privateinternetaccess.com -j ACCEPT
#Allow traffic to PIA DNS
iptables -A INPUT -s 209.222.18.222 -j ACCEPT
iptables -A OUTPUT -d 209.222.18.222 -j ACCEPT

#Accept all TUN connections (tun = VPN tunnel)
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT

#Set default policies to drop all communication unless specifically allowed
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

My script to start the VPN

pkill openvpn
sleep 5
#choose a VPN server
/usr/sbin/openvpn --daemon --management 127.0.0.1 6001 --config "UK London.ovpn"
#/usr/sbin/openvpn --daemon --management 127.0.0.1 6001 --config "Hong Kong.ovpn"
sleep 10
#replace current DNS servers with PIA
/bin/echo nameserver 209.222.18.222  | /usr/bin/tee /etc/resolv.conf
/bin/echo nameserver 209.222.18.218  | /usr/bin/tee -a /etc/resolv.conf
#get rid of current default gateway so that if VPN drops all traffic stops- only traffic allowed is to PIA VPN and DNS servers
route del default gw 192.168.1.1