Firewall Rules - Block all connections except VPN

[c744ebc7-01f6-47a3-bd84-6]

I am currently using an ASUS router (RT-AC68U with Merlin firmware - 386.4). I want to connect a single client to an OpenVPN server with no traffic other than the VPN allowed. I don't want to use the OpenVPN client in the router as speeds are low when using the VPN, so I'm looking to use an OpenVPN application on the client to connect to the server. I want to make sure that only the VPN traffic is allowed from the client.

How do I do that? Should I create a firewall rule that blocks all traffic from the client and another one with higher priority that allows connection to the VPN server's IP address? If that is the case, how do I create firewall rules in the router's web interface?

If I need to use iptables to create firewall rules, can someone help me with that or give me some links to a beginner's guide?

 

[Tech Junky]

Just use the PC client to connect and by default everything from the PC is tunneled.

If you want speed though use wireguard as it will get you closer to the actual speed you're paying for.

 

[c744ebc7-01f6-47a3-bd84-6]

Just use the PC client to connect and by default everything from the PC is tunneled.

If you want speed though use wireguard as it will get you closer to the actual speed you're paying for.

Is there any way to ensure that everything is tunneled using the router? Having that separation from the client will give me additional peace of mind.

Speed is fine when using OpenVPN on the client, but it doesn't hurt to use WireGuard.

 

[CaptainSTX]

Many if not most VPN applications that run on a PC have a kill switch setting so if the tunnel goes down your connection to the WWW is blocked.

 

[c744ebc7-01f6-47a3-bd84-6]

Yes, but I would like to have an additional layer of security/protection.

 

[Tech Junky]

Yes, but I would like to have an additional layer of security/protection.

What exactly are you talking about here?

Either you're fully encrypted in a tunnel or you're not. There's no in between.

There are some stupid providers though that leak DNS / webRTC info though.

VPN Tests - How to Check if Your VPN is Working in 2024

Never trust a VPN without testing it. This guide shows you how to test your VPN for DNS leaks, IP address leaks, WebRTC leaks, and speed.

restoreprivacy.com

 

[eibgrad]

As I understand it, the OP wants the client to host the OpenVPN client for performance reasons, but somehow have the *router* ensure the client is actually using its OpenVPN client.

The only thing I can suggest is perhaps determining what are the valid OpenVPN servers available from the OpenVPN provider, then limiting the client to those specific servers, and perhaps based on UDP vs. TCP as well. IOW, the reverse to what you more typically see, where the router would block access to a VPN on the same basis.

iptables -I FORWARD -i br0 -s 192.168.1.100 -j REJECT
iptables -I FORWARD -i br0 -s 192.168.1.100 -d 177.177.177.177 -j ACCEPT
iptables -I FORWARD -i br0 -s 192.168.1.100 -d 188.188.188.188 -j ACCEPT
iptables -I FORWARD -i br0 -s 192.168.1.100 -d 199.199.199.199 -j ACCEPT

Or if you wanted to be even more specific ...

iptables -I FORWARD -p udp -i br0 -s 192.168.1.100 -j REJECT
iptables -I FORWARD -p udp -i br0 -s 192.168.1.100 -d 177.177.177.177 --dport 1194 -j ACCEPT
iptables -I FORWARD -p udp -i br0 -s 192.168.1.100 -d 188.188.188.188 --dport 1194 -j ACCEPT
iptables -I FORWARD -p udp -i br0 -s 192.168.1.100 -d 199.199.199.199 --dport 1194 -j ACCEPT

These would need to be added using a firewall-start script.

P.S. Sorry, I had originally wrote those rules incorrectly. I just modified them.

 

[Techwrench]

Another option is a separate dedicated device for the vpn, such as a gl.inet mango travel router. They fit in a shirt pocket, run a gl.inet custom version of open-wrt and handle vpn duty like a champ among many other things. It has long been my belief that running a vpn ON the device you are trying to protect is less than ideal. The pc knows where it is and what real network it is on, so could be compromised. Boot the pc behind a stand-alone vpn device and even if the pc is compromised, it reveals nothing. Overkill? Probably, but why not it's only money and more cool gadgets.

 

[Tech9]

gl.inet mango travel router... handle vpn duty like a champ.

Mango? This one is very slow. Under 10Mbps on OpenVPN. Good for travel router only.