Ubuntu – How to block traffic over wifi before the VPN connects

networkingSecurityvpnwireless

I'd like to use a VPN when on public wifi for security. In order to establish my OpenVPN tunnel I need a working network connection. When I connect to a public wifi access point there is a window of time after connecting but before my VPN client is launched, connects and updates the route table, during which traffic from my system travels unencrypted over public wifi.

How can I cause wifi to pass no traffic except traffic destined for my OpenVPN server during that window of time?

Extra credit : Is there a way to whitelist wifi networks as trusted (like my home or work wifi) such that all traffic is allowed as I won't be using a VPN?

Best Answer

I would try the following with iptables, in this order:

# Allow dhcp
sudo iptables -A OUTPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT

# Allow outbound VPN traffic
sudo iptables -A OUTPUT -p udp --dport 1194 -d 0.0.0.0/0   -j ACCEPT" 

# DROP all outbound WIFI
sudo iptables -A OUTPUT -i wlan0 -j DROP

In office and home network you will have to run:

# Accept all outbound traffic
sudo iptables -D OUTPUT -i wlan0 -j DROP

There might be an iptables extension which will filter using WIFI SSID or some other router identifier, but I am not familiar with any

NOTE: you might need to update the ovpn remote port and/or WIFI network interface name

Related Question