I'm running OS X 10.8 and have Tunnelblick set up so I can connect to my OpenVPN server at home. I've also used this at $WORK in the past.

When I'm out and about and want to jump on a public network, I'd like to prevent any network traffic before the VPN is connected.

However, when connected to known "safe" networks, connections should be allowed without a VPN connection.

I think I can accomplish most of this with pre/post connect scripts in Tunnelblick, but that only works when the VPN connection is initiated. I need to hook in to the OS to have it automatically disable the blocks when connected to a whitelist of networks...

Any ideas?

closed as off topic by user10211, Adi, TildalWave, NULLZ, AJ Henderson Jun 3 '13 at 12:45

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You can use ipfw and allow connections only from/to and the IP address of your VPN provider. – Adi Jun 2 '13 at 9:36

That's what I'm using Little Snitch for.

You can set up different profiles, so for instance you can create a profile for untrusted networks that only allows VPN traffic and is selected by default for unknown networks. Once the VPN connection is set up Little Snitch can automatically switch to a profile for trusted networks, allowing all traffic.

Of course you can create as many profiles as you want, allowing or denying any traffic you wish.

Not the answer you're looking for? Browse other questions tagged or ask your own question.