OpenVPN "kill switch"

[DannyPM]

Hi,
Is there any configuration or package that can kills the internet connection to the devices served by the VPN tunnel when the VPN is down?
For some reason I experience DNS leak when connecting to some locations via OpenVPN. How can I plug the leak.
I'm using a WRT1200AC router and ExpressVPN for privacy.

Thank you

[psherman]

@DannyPM

Hi,
Is there any configuration or package that can kills the internet connection to the devices served by the VPN tunnel when the VPN is down?

Just remove the firewall rule that allows forwarding from the network to WAN. It should look something like this:

config forwarding
	option dest 'wan'
	option src 'lan'

[dbischof90]

Same question, did the same - but what about the router itself? The WRT can still access the net!

[mikma]

dbischof90, I answered it in your topic. In case someone else is interested in the answer.

Routing question - Routing the router over LAN

I assume your WAN and VPN connections are in different firewall zones. Have you tried to reject "output" in the WAN zone? After doing that you can add traffic rules for the traffic you need, i.e. to the VPN server and maybe the DNS server if you need to look up the IP address of the VPN server.

[psherman]

@dbischof90 - The router, by definition, must always have access to the internet, or else it would not be able to contact the VPN server to establish the tunnel in the first place. You might be able to construct firewall rules to limit outgoing traffic -- only allowing certain destination hosts, for example -- but it might end up causing lots of headaches.