Raspbian Jessie, Route all traffic through VPN, Close if VPN goes down

Question

I'm not a very experienced Linux user but I've managed to setup a connection to a VPN using OpenVPN on my Raspberry Pi 2 Model B running Raspbian Jessie. So I've got a eth0 and tun0 interface running.

Basically I want to close its connection to the Internet when or if the VPN shuts down. Like a kill switch. I've seen some solutions using iptables or setting up default routes but I cannot seem to understand how they work, and therefore I can't apply them to my problem.

How would I achieve this?

Thanks

Answer 1

I might have solved this issue using iptables. For example, I am running deluged as a user called deluge that belongs to a group called deluge. Setting up these iptables rules I believe only allows traffic for the deluge group on the tun0 interface and no other.

sudo iptables -A OUTPUT -m owner --gid-owner deluge -o lo -j ACCEPT
sudo iptables -A OUTPUT -m owner --gid-owner deluge -d 192.168.0.0/24 \! -o tun0 -j ACCEPT
sudo iptables -A OUTPUT -m owner --gid-owner deluge  \! -o tun0 -j REJECT

It basically allows traffic on the loopback device, IPs on my local network and rejects anything that is not going through the tun0 interface for the deluge group. I'm not very experienced using iptables. Can these rules be improved? Am I overlooking anything?

The traffic does stop and start as I switch the VPN on and off.

source

Answer 2

Configure your routing table in Linux. Fairly straightforward, but will depend on your current configuration.

Type route -n to see your current routing table.

Note the default route (the one that's destination 0.0.0.0), that matches everything. The basic way a routing table works is that traffic will match the most specific rule -- all it needs to know is where the first hop should go. So a command like:

sudo route add -net 10.0.0.0/8 ppp0
sudo route add -net 1.2.3.0/24 ppp0

would add a line to your routing table that will take send any traffic going to an address matching those rules (all IP addresses that start with 10.*.*.* for the first rule and all IP addresses that match 1.2.3.* for the second rule) and send traffic to the ppp0 interface. (Assuming its ppp0 interface).