Is this possible? If not through ufw then some other software or iptables? How should I set up the ip tables?
Assuming my public ip is known (and I don't want to change it), would it provide complete security against hacking if I don't perform any wrong actions such as downloading infected files?
If not complete security then would it provide additional security? Like making nmap scans impossible?
Inbound Traffic
It seems like the threat you are concerned about is "hacking", which I will interpret in this case as "exploitation of locally running network services by malicious actors".
If this is your threat model, and we disregard out other privacy/security implications and potential benefits of using a VPN, I suspect the VPN has little to offer in this case.
First off, if your public address is known to an adversary, and you do not have any public-facing network services or they are firewalled off, the above threat model is effectively mitigated. Full stop. Any unwarranted traffic inbound to your device should be silently dropped with no effect to you*. If you are behind a network firewall (possibly providing NAT), you have even less to worry about, since stray traffic will not reach your device unless you have specifically enabled port forwarding (or UPnP is enabled)**.
So, a VPN doesn't help much with inbound traffic if you already have a firewall that denies by default. Unless you have specifically requested/configured it, a commercial VPN service is not going to allow public traffic to be sent to your device. That said, if the VPN provider is compromised, malicious actors could use the VPN as a channel to reach your device even while on your private network. But again, with a firewall, such inbound attacks are likely null and void.
Outbound Traffic
In the case I am interpreting your question incorrectly, and you mean traffic to the VPN instead of from the VPN, there could be an advantage to only allowing outbound traffic across a VPN. A likely scenario is that you are using untrusted public WiFi, perhaps in an airport. While the modern internet over HTTPS is fairly secure against MitM attacks, there are still privacy ramifications of using a public network. Modern devices are also very noisy, and could unintentionally reveal information about you or your devices that could result in privacy issues or compromise. For example, look into the tool Responder, which targets Windows devices on the same network by responding to queries they automatically make, sometimes without prompt from the user. To prevent your computer from leaking more information to the network than necessary, you can indeed lock down all outbound traffic to a VPN adapter. Example below with iptables (although any firewall should suffice):
# Name of VPN network adapter
VPN_IF=tun0
VPN_SERVER=1.2.3.4
VPN_PORT=1194
# Allow inbound connections related to things you initiate on any interface
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow all out to VPN
iptables -A OUTPUT -o $VPN_IF -j ACCEPT
# Assuming UDP
iptables -A OUTPUT -p udp --dport $VPN_PORT -d $VPN_SERVER -j ACCEPT
# Allow DHCP
iptables -A OUTPUT -p udp --dport 67 -j ACCEPT
iptables -A INPUT -p udp --dport 68 -j ACCEPT
# Default drop the rest
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
That should do it. Note you may need to make changes specific to your scenario. If your VPN configuration uses a hostname for the VPN server instead of an IP address, you will need to allow DNS outbound too. You also may need to allow multiple IP addresses if the server resolves to more than one address.
* Ignoring the possibility of a bug in the kernel firewall code.
** A vulnerability in your edge router/firewall would remove any of this possible protection.
