I'm not a very experienced Linux user but I've managed to setup a connection to a VPN using OpenVPN on my Raspberry Pi 2 Model B running Raspbian Jessie. So I've got a eth0 and tun0 interface running.

Basically I want to close its connection to the Internet when or if the VPN shuts down. Like a kill switch. I've seen some solutions using iptables or setting up default routes but I cannot seem to understand how they work, and therefore I can't apply them to my problem.

How would I achieve this?


2 Answers 2


I might have solved this issue using iptables. For example, I am running deluged as a user called deluge that belongs to a group called deluge. Setting up these iptables rules I believe only allows traffic for the deluge group on the tun0 interface and no other.

sudo iptables -A OUTPUT -m owner --gid-owner deluge -o lo -j ACCEPT
sudo iptables -A OUTPUT -m owner --gid-owner deluge -d \! -o tun0 -j ACCEPT
sudo iptables -A OUTPUT -m owner --gid-owner deluge  \! -o tun0 -j REJECT

It basically allows traffic on the loopback device, IPs on my local network and rejects anything that is not going through the tun0 interface for the deluge group. I'm not very experienced using iptables. Can these rules be improved? Am I overlooking anything?

The traffic does stop and start as I switch the VPN on and off.



Configure your routing table in Linux. Fairly straightforward, but will depend on your current configuration.

Type route -n to see your current routing table.

Note the default route (the one that's destination, that matches everything. The basic way a routing table works is that traffic will match the most specific rule -- all it needs to know is where the first hop should go. So a command like:

sudo route add -net ppp0
sudo route add -net ppp0

would add a line to your routing table that will take send any traffic going to an address matching those rules (all IP addresses that start with 10.*.*.* for the first rule and all IP addresses that match 1.2.3.* for the second rule) and send traffic to the ppp0 interface. (Assuming its ppp0 interface).

  • I can't seem to be able to add these routes unless I am already connected to the VPN. In my case that interface would be tun0. I get this message: sudo route add -net tun0 SIOCADDRT: No such device.
    – pwik
    Jun 3, 2016 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.