Objective
Use iptables to block all Internet connections in the event your VPN is disconnected.
Distributions
This will work on any Linux distribution.
Requirements
A working Linux install with root privileges.
Conventions
- # – requires given linux commands to be executed with root privileges either directly as a root user or by use of
sudocommand - $ – requires given linux commands to be executed as a regular non-privileged user
Introduction
If you’re connected to a VPN, you need a killswitch. No, it’s not as metal as it sounds. It’s just a mechanism that stops your Internet connection when you’re disconnected from the VPN. It protects you from inadvertently leaking sensitive information onto the Internet when the VPN connection drops.
Some VPN services provide clients with a built-in killswitch, but none are as reliable as using iptables. Since iptables is independent of your VPN service, and it’s integrated into the kernel itself, it won’t fail when your VPN does. Iptables is also a well-proven security technology that can and will keep your computer safe.
Sysctl
Before you start creating iptables rules, you should make some alterations to the sysctl configuration. In some distributions, it’s located at /etc/sysctl.d/99-sysctl.conf. Others have it at /etc/sysctl.conf. Open up that file, and locate the following line and change it to match the example here.
net.ipv4.ip_forward=1
Then, add the following lines to the bottom of the file. Be sure to change the interfaces to match the ones on your machine.
net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 net.ipv6.conf.lo.disable_ipv6 = 1 net.ipv6.conf.eth0.disable_ipv6 = 1
Save and exit. Then run:
# sysctl -p
Set Up The Document
Now you can create a file for your rules. It doesn’t really matter where you make it, so just make one. It’ll be referred to as ipv4 for this guide.
Start the file by adding the following lines. They will be the beginning and end of the file.
*filter COMMIT
Base Rules
Before you configure iptables to allow any traffic you need to switch its default to disallow all traffic. Add these three rules to drop all traffic by default.
-P INPUT DROP -P FORWARD DROP -P OUTPUT DROP
Input
It’s most secure to only allow inbound traffic from established or related connections. Set that up next.
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
Loopback and Ping
Next, allow the loopback interface and ping.
-A OUTPUT -o lo -j ACCEPT -A OUTPUT -o tun0 -p icmp -j ACCEPT
This assumes that your VPN connection is on tun0. Check that with ip a, if you’re not sure.
LAN
It doesn’t make much sense to shut down or block your LAN traffic, especially on a home network, so allow that too.
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
DNS
For this next part, you’re going to need to know the IP address of your VPN’s DNS server(s). If your VPN has access or your resolv.conf, you’ll probably find them i there.
-A OUTPUT -d 10.45.16.1 -j ACCEPT
Allow The VPN
Of course, you need to allow the VPN itself. There are two parts to this. You need to allow both the service port and the interface.
-A OUTPUT -p udp -m udp --dport 1194 -j ACCEPT -A OUTPUT -o tun0 -j ACCEPT
Again, check the port and interface that your VPN connection is using.
You could stop here. This will work just fine for a killswitch. However, if you want iptables to function as a regular firewall and block connections on unwanted ports too, you can do that.
From here, you would delete the last line that accepts all traffic on tun0, and replace it with specific allowances for the ports that you want to allow.
-A OUTPUT -o tun0 -p tcp --dport 443 -j ACCEPT -A OUTPUT -o tun0 -p tcp --dport 80 -j ACCEPT -A OUTPUT -o tun0 -p tcp --dport 993 -j ACCEPT -A OUTPUT -o tun0 -p tcp --dport 465 -j ACCEPT
You get the general idea. It’s longer and more tedious, but it gives you more control over what traffic gets through.
IPv6
IPv6 is really bad for VPNs right now. Most don’t adequately support it, and your information can leak out over that connection. It’s best to shut it down altogether.
Create another file for IPv6 and block everything.
-P INPUT DROP -P FORWARD DROP -P OUTPUT DROP
Commit
You need to import your files into iptables in order for them to take effect. First, clear out any old rules.
# iptables -F && iptables -X
Import the new ones from your files.
# iptables-restore < /tmp/ipv4 # ip6tables-restore < /tmp/ipv6
Make It Permanent
Iptables doesn’t save its state after a reboot by default. You need to set that up yourself.
Debian/Ubuntu
Debian-based systems have a program called, iptables-persistent. It’s a service that handles backing up and loading your configurations.
When you install it, iptables-persistent will ask you if you want to save your existing configuration. Say yes.
# apt install iptables-persistent
Since Debian systems run services on startup by default, you don’t need to do anything else.
Other Systemd
Other systems have a couple of different ways to handle this. The first is to edit /etc/sysconfig/iptables-config. There will be one of two lines there. Edit the one that you have to look like the following.
IPTABLES_SAVE_ON_STOP="yes" OR IPTABLES_SAVE_ON_RESTART="yes"
The other way is to use the save and restore functions of iptables. Create a directory where you want to save your rules.
# mkdir /etc/iptables/ # iptables-save > /etc/iptables/iptables.rules # ip6tables-save > /etc/iptables/ip6tables.rules
Then, create a script to load those rule when your computer boots up.
#! /bin/bash iptables-restore < /etc/iptables/iptables.rules; ip6tables-restore < /etc/iptables/ip6tables.rules;
OpenRC
OpenRC systems like Gentoo have their own way of saving the configurations.
# rc-service iptables save # rc-service ip6tables save # rc-service iptables start # rc-service ip6tables start # rc-update add iptables default # rc-update add ip6tables default
Closing Thoughts
Using an iptables-based killswitch makes your VPN much more secure. Leaking data makes totally defeats the purpose of using a VPN, so stopping leaks should be a top priority.
Do not trust the so-called killswitches baked into VPN clients. Most don’t work. The only way to really ensure that your data isn’t leaking is to do it yourself with iptables.
