I bought a subscription to a VPN service and I am using the openvpn 2.5.1 client to connect to it. I am using Ubuntu 20.10.
I now want to emulate the "kill switch" feature of most proprietary VPN client.
That is, I want to block any connection that is not tunneled through the VPN. Said otherwise, if the VPN connection drops for some reason (eg. server unreachable), I want all internet connection to be blocked.
To achieve this result, I am following this tutorial.
I have come up with the following iptables rules:
*filter
# Drop all packets
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
# Allow incoming packets only for related and established connections
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Allow loopback and tunnel interface
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o tun0 -p icmp -j ACCEPT
# Allow local LAN
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
# Allow VPN's DNS servers
# Gli indirizzi del server DNS di NordVPN sono 103.86.96.100 e 103.86.99.100
-A OUTPUT -d <DNS_SERVER_1> -j ACCEPT
-A OUTPUT -d <DNS_SERVER_2> -j ACCEPT
# Allow the VPN itself (both protocol/port and interface)
# We use TCP/443
#-A OUTPUT -p udp -m udp --dport 1194 -j ACCEPT
#-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp --dport 443 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
COMMIT
and I am importing it with sudo iptables-restore < ./vpn_iptables_killswitch_rules.ipv4
.
After the import I am able to connect to the VPN successfully. That is, the openvpn
client establishes the connection successfully.
However, I am unable to resolve domain name in IP addresses. In fact, ping google.com
returns a temporary failure in name resolution, while traceroute 8.8.8.8
works without problems.
This should not happen since I have whitelisted the DNS servers on my rules.
A nmcli connection show <SSID>
shows that the connection is using the DNS servers provided by my VPN provided and is ignoring the DNS servers provided by DHCP.
What I am doing wrong here?