currently I'm using iptables as a kill-switch for my VPN connection. Therefore I only have one rule :
-A OUTPUT -o eth0 -m owner --uid-owner 1000 -j DROP
everything else is accepted.
Now the problem is I actually want to access other computers in my internal network which runs on the eth0 interface but I still want to have a VPN kill-switch kind of thing...
I already tried a few things but as I'm no networking professional I'm pretty much stuck here.
Appreciate every kinda help. Cheers!
I had the same problem and a couple of similar ones so here's my complete iptables OUTPUT chain which is all I use and should solve your problem and then some.
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT
-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP
Here's what all it's doing:
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
This command allows all traffic on your local network. The -d parameter causes the rule to apply to all traffic going to the destination ip. Change 192.168.1 to the first three parts of your local network ip address. For example if your local network ip ranges is from 15.15.15.0 to 15.15.15.255 change that line to
-A OUTPUT -d 15.15.15.0/24 -j ACCEPT
The .0/24 at the end will include all ip addresses on that network.
-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT
This allows local programs on your computer to talk to each other. This was causing problems for me so I thought I would include it. Specifically one of my programs needed this to work with the vpn client.
-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP
These two commands drop any outgoing packets that don't go out a tun connection. In yours you use eth0 instead of tun+. Have you tested whether that actually works as a kill switch? I don't think it should because when your vpn connection goes down eth0 should remain.
In order for this to work the order matters. If the accept commands aren't first they will get blocked by the drop commands.
