Implementing an OpenVPN "kill switch" with iptables

I'm trying to implement a set of iptables rules for OpenVPN:

1. Everything (without exception) goes through OpenVPN
2. If OpenVPN is down or inaccessible everything (without exception) cannot access the internet
3. Local access is always possible, irrespective of the status of OpenVPN

The best (out of six examples) I've seen so far is this, however it still allows access to the internet when the VPN is down through ipv6:

# Clean down existing rules iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -t nat -F iptables -t mangle -F iptables -F iptables -X ip6tables -P INPUT ACCEPT ip6tables -P FORWARD ACCEPT ip6tables -P OUTPUT ACCEPT ip6tables -t nat -F ip6tables -t mangle -F ip6tables -F ip6tables -X # Allow loopback device (internal communication) iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow all local traffic. iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT # Allow VPN establishment iptables -A OUTPUT -p udp --dport 1194 -j ACCEPT iptables -A INPUT -p udp --sport 1194 -j ACCEPT # Accept all TUN connections (tun = VPN tunnel) iptables -A OUTPUT -o tun+ -j ACCEPT iptables -A INPUT -i tun+ -j ACCEPT # Set default policies to drop all communication unless specifically allowed iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP 

If I try to blanket block all ipv6 traffic (which is what a number of examples suggest) then I cannot connect to anything:

# Set default policies to drop all communication unless specifically allowed ip6tables -P INPUT DROP ip6tables -P OUTPUT DROP ip6tables -P FORWARD DROP 

If I try to mirror what is in the ipv4 section then I have this:

# Allow loopback device (internal communication) ip6tables -A INPUT -i lo -j ACCEPT ip6tables -A OUTPUT -o lo -j ACCEPT # Allow all local traffic. # (Skipped as I don't know how to do this) # Allow VPN establishment ip6tables -A OUTPUT -p udp --dport 1194 -j ACCEPT ip6tables -A INPUT -p udp --sport 1194 -j ACCEPT # Accept all TUN connections (tun = VPN tunnel) ip6tables -A OUTPUT -o tun+ -j ACCEPT ip6tables -A INPUT -i tun+ -j ACCEPT 

Now I'm unable to connect to anywhere and curl just hangs.

How can I fix this?

4 Answers

Future readers, be aware that the rules presented here "will allow deanonymization because it allows any connection over port 1194, not just traffic originating from OpenVPN". This answer presents a much simpler set of rules which do not require hardcoding any IPs or ports.

It turns out that I'd not whitelisted the DNS servers of the VPN service. Once I did that, I was able to blacklist ipv6 without an issue.

Please note: As per Rock Storm's comment, this is probably not the best way of doing this as it allows any connection over port 1194. See this answer for a better approach which doesn't require hardcoding any IPs or ports - however it needs a further modification to allow local traffic (which, in my case, is allowing input and output for 192.168.0.0/16)

For the sake of completeness, this is what I finally got to work. Three things to bear in mind:

1. You should replace [Primary DNS IP here] and [Secondary DNS IP here] with the IP addresses of the DNS servers you're planning to use
2. Don't forget to edit /etc/resolvconf.conf to add the IP addresses in #1 as nameservers and blacklist your own to avoid DNS leakages.
3. This assumes your local traffic has an IP range starting 192.168. If not, you'll need to change this.

Code as follows:

# Remove any existing rules sudo iptables -P INPUT ACCEPT sudo iptables -P FORWARD ACCEPT sudo iptables -P OUTPUT ACCEPT sudo iptables -t nat -F sudo iptables -t mangle -F sudo iptables -F sudo iptables -X sudo ip6tables -P INPUT ACCEPT sudo ip6tables -P FORWARD ACCEPT sudo ip6tables -P OUTPUT ACCEPT sudo ip6tables -t nat -F sudo ip6tables -t mangle -F sudo ip6tables -F sudo ip6tables -X # Allow loopback device (internal communication) sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A OUTPUT -o lo -j ACCEPT # Allow all local traffic sudo iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT sudo iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT # Allow DNS (could be VPN provider or someone like Cloudflare's 1.1.1.1) sudo iptables -A OUTPUT -d [Primary DNS IP here] -j ACCEPT sudo iptables -A OUTPUT -d [Secondary DNS IP here] -j ACCEPT # Allow related and established connections sudo iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # Allow VPN establishment sudo iptables -A OUTPUT -p udp --dport 53 -j ACCEPT sudo iptables -A INPUT -p udp --sport 53 -j ACCEPT sudo iptables -A OUTPUT -p udp --dport 1198 -j ACCEPT sudo iptables -A INPUT -p udp --sport 1198 -j ACCEPT # Accept all tun0 (VPN tunnel) connections sudo iptables -A OUTPUT -o tun0 -j ACCEPT sudo iptables -A INPUT -i tun0 -j ACCEPT # Allow for nslookup to not throw an error sudo ip6tables -I OUTPUT 1 -p udp -s 0000:0000:0000:0000:0000:0000:0000:0001 -d 0000:0000:0000:0000:0000:0000:0000:0001 -j ACCEPT # Drop everything else (ipv4) sudo iptables -P INPUT DROP sudo iptables -P OUTPUT DROP sudo iptables -P FORWARD DROP # Drop everything (ipv6) sudo ip6tables -P INPUT DROP sudo ip6tables -P OUTPUT DROP sudo ip6tables -P FORWARD DROP 

Your example script cleans all rules for IPv4 and IPv6 rulesets... but doesn't add any rules for IPv6.

Notice how the "Clean down existing rules" section calls both iptables and ip6tables, resetting both firewalls to their default "wide open" state. The remaining sections, however, do nothing with ip6tables at all.

I just fell over this topic, and have a comment and some additional information.

My objective was to have a VPN connection and killswitch (running on tun0) with a network gateway to share the VPN service on the local lan..on the server ip (used as gateway on various PCs and TVs. etc)

But I would also like to access the server over SSH on the WAN IP!

I also what to run a second private VPN on tun1, so I can access my local LAN from anywhere.

So. I run a VPN client with killswitch and gateway and a VPN server. And I have full VPN and SSH access on the global WAN IP

This complicate things a bit.

Also the line

#Allow related and established connections sudo iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 

Will disable the killswitch sever side!!!. The gateway is ok, but programs link a torrent-client etc, will still have access to the net if the main vpn is down.

Here is my solution

IT works pretty well.

Can any iptables gurus find any loopholes etc in the setup then please comment.

I have made it as a script to active the setup. It makes it a bit more easy when debugging and setting to no firewall. Its not really persistent, so either commit it properly or run on startup with systemd.

#!/bin/sh #A link to this script runs as a systemd runscript #Here: #nano /usr/local/bin/fwmark.sh echo running NEW set_iptabels # Clean down existing rules iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -F iptables -X ip6tables -P INPUT ACCEPT ip6tables -P FORWARD ACCEPT ip6tables -P OUTPUT ACCEPT ip6tables -t nat -F ip6tables -t nat -X ip6tables -t mangle -F ip6tables -F ip6tables -X #Start Killswitch configuration # Allow loopback device (internal communication) iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow all local traffic iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT # Allow DNS iptables -A OUTPUT -d 4.2.2.2 -j ACCEPT iptables -A OUTPUT -d 4.2.2.3 -j ACCEPT # Allow related and established connections # DO NOT RUN THIS---LOTS OF GUIDES SAY TO..IT DISABLES THE KILLSWITCH SERVER SIDE. GATEWAY IS OK SEVER NOT!!!!!!!! #### DONT RUN >>iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # Allow VPN establishment iptables -A OUTPUT -p udp --dport 53 -j ACCEPT iptables -A INPUT -p udp --sport 53 -j ACCEPT iptables -A OUTPUT -p udp --dport 1912 -j ACCEPT iptables -A INPUT -p udp --sport 1912 -j ACCEPT # Accept all tun0 (VPN tunnel) connections iptables -A OUTPUT -o tun0 -j ACCEPT iptables -A INPUT -i tun0 -j ACCEPT # Allow for nslookup to not throw an error ip6tables -I OUTPUT 1 -p udp -s 0000:0000:0000:0000:0000:0000:0000:0001 -d 0000:0000:0000:0000:0000:0000:0000:0001 -j ACCEPT # Drop everything else (ipv4) iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # Drop everything (ipv6) ip6tables -P INPUT DROP ip6tables -P OUTPUT DROP ip6tables -P FORWARD DROP #End Killswitch #Gatewate forward #ssh port 80 etc are set to route to enp6s0 via mark 65 rule created here: ip rule add fwmark 65 table novpn > /dev/null 2>&1; ip route add default via 192.168.1.1 dev enp6s0 table novpn > /dev/null 2>&1; ip route flush cache > /dev/null 2>&1; #VPN Gateway iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE iptables -A FORWARD -i tun0 -o enp6s0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i enp6s0 -o tun0 -j ACCEPT #Set connection port for Access from WAN #ssh force private global IP IN AND OUT iptables -A INPUT -p tcp --sport 22 -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -o enp6s0 -p tcp -m tcp --sport 22 -m comment --comment "ssh-22" -j ACCEPT iptables -A OUTPUT -o enp6s0 -p tcp -m tcp --dport 22 -m comment --comment "ssh-22" -j ACCEPT iptables -t mangle -A OUTPUT -p tcp --sport 22 -j MARK --set-mark 65 iptables -t mangle -A OUTPUT -p tcp --sport 22 -j MARK --set-mark 65 iptables -A INPUT -i tun0 -p tcp -m tcp --sport 22 -j DROP iptables -A INPUT -i tun0 -p tcp -m tcp --dport 22 -j DROP iptables -A OUTPUT -o tun0 -p tcp -m tcp --sport 22 -j DROP iptables -A OUTPUT -o tun0 -p tcp -m tcp --dport 22 -j DROP #Private VPN ON tun1 IN AND OUT - use TCP! UDP will give endless TLS errors, that are currently unresolved. iptables -A INPUT -p tcp --sport 1194 -j ACCEPT iptables -A INPUT -p tcp --dport 1194 -j ACCEPT iptables -A OUTPUT -o enp6s0 -p tcp -m tcp --sport 1194 -m comment --comment "vpn-1194" -j ACCEPT iptables -A OUTPUT -o enp6s0 -p tcp -m tcp --dport 1194 -m comment --comment "vpn-1194" -j ACCEPT iptables -t mangle -A OUTPUT -p tcp --sport 1194 -j MARK --set-mark 65 iptables -t mangle -A OUTPUT -p tcp --dport 1194 -j MARK --set-mark 65 iptables -A INPUT -i tun0 -p tcp -m tcp --sport 1194 -j DROP iptables -A INPUT -i tun0 -p tcp -m tcp --dport 1194 -j DROP iptables -A OUTPUT -o tun0 -p tcp -m tcp --sport 1194 -j DROP iptables -A OUTPUT -o tun0 -p tcp -m tcp --dport 1194 -j DROP #http force private global IP OUT ONLY iptables -A INPUT -p tcp --sport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -t mangle -A OUTPUT -p tcp --sport 80 -j MARK --set-mark 65 iptables -t mangle -A OUTPUT -p tcp --sport 80 -j MARK --set-mark 65 iptables -A INPUT -i tun0 -p tcp -m tcp --sport 80 -j DROP iptables -A INPUT -i tun0 -p tcp -m tcp --dport 80 -j DROP #End WAN access #Specific private VPN server setup on tun1 service Activate with>> openvpn@server start/stop/status #Private VPN Server iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o enp6s0 -j MASQUERADE iptables -A FORWARD -i tun1 -o enp6s0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i enp6s0 -o tun1 -j ACCEPT #VPN server forward iptables -A FORWARD -i tun1 -o enp6s0 -s 10.8.0.0/24 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #Local LAN access iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o enp6s0 -j SNAT --to-source 192.168.1.100 # VPN Server enable tun1 iptables -A INPUT -i tun1 -j ACCEPT iptables -A FORWARD -i tun1 -j ACCEPT iptables -A OUTPUT -o tun1 -j ACCEPT #End Private VPN Server #save and make persistant - remove all putput from logfile iptables-save >/etc/iptables/rules.v4 > /dev/null 2>&1; ip6tables-save >/etc/iptables/rules.v6 > /dev/null 2>&1; netfilter-persistent save > /dev/null 2>&1;