I bought a subscription to a VPN service and I am using the openvpn 2.5.1 client to connect to it. I am using Ubuntu 20.10.
I now want to emulate the "kill switch" feature of most proprietary VPN client.
That is, I want to block any connection that is not tunneled through the VPN. Said otherwise, if the VPN connection drops for some reason (eg. server unreachable), I want all internet connection to be blocked.
To achieve this result, I am following this tutorial.
I have come up with the following iptables rules:
*filter # Drop all packets -P INPUT DROP -P FORWARD DROP -P OUTPUT DROP # Allow incoming packets only for related and established connections -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # Allow loopback and tunnel interface -A OUTPUT -o lo -j ACCEPT -A OUTPUT -o tun0 -p icmp -j ACCEPT # Allow local LAN -A OUTPUT -d 192.168.1.0/24 -j ACCEPT # Allow VPN's DNS servers # Gli indirizzi del server DNS di NordVPN sono 18.104.22.168 e 22.214.171.124 -A OUTPUT -d <DNS_SERVER_1> -j ACCEPT -A OUTPUT -d <DNS_SERVER_2> -j ACCEPT # Allow the VPN itself (both protocol/port and interface) # We use TCP/443 #-A OUTPUT -p udp -m udp --dport 1194 -j ACCEPT #-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT -A OUTPUT -p tcp --dport 443 -j ACCEPT -A OUTPUT -o tun0 -j ACCEPT COMMIT
and I am importing it with
sudo iptables-restore < ./vpn_iptables_killswitch_rules.ipv4.
After the import I am able to connect to the VPN successfully. That is, the
openvpn client establishes the connection successfully.
However, I am unable to resolve domain name in IP addresses. In fact,
ping google.com returns a temporary failure in name resolution, while
traceroute 126.96.36.199 works without problems.
This should not happen since I have whitelisted the DNS servers on my rules.
nmcli connection show <SSID> shows that the connection is using the DNS servers provided by my VPN provided and is ignoring the DNS servers provided by DHCP.
What I am doing wrong here?