Block a client is a tunnel VPN is down

[bokolobs]

Hi! I have a client that uses a tunnel VPN. I want to block this client from reaching the internet if and when the VPN connection goes down. Where and how do I this? Filter rules or Firewall app?

Thanks in advance!

[ccdmnk]

I use filter rules with tag 'tunnel' for every device going out tunnelvpn interface:

1st rule - allow tagged hosts to exit tunnelvpn interfaces
2nd rule - deny tagged hosts to exit any other wan interface (and for me also every internal network)

Port forward rules:
1. tagged hosts DNS Traffic (udp/tcp, 53) forwarded to DNS of vpn provider

Tunnel rules.
1. Tagged hosts route through tunnel
2 vpn provider dns (ip) route through tunnel

[bokolobs]

Thank you for this.

[sky-knight]

Firewall App is what you use. There are several methods to select the client, username or IP address, and then simply block traffic destined to any interface that isn't OpenVPN.

[ccdmnk]

Firewall App is what you use. There are several methods to select the client, username or IP address, and then simply block traffic destined to any interface that isn't OpenVPN.

Why not filter rules? As per that thread the other day, firewall does not block ICMP. If you make it a filter rule, does it not block *everything* before it even touches the other apps?
I've ran this for a while now and I cant see any traffic escaping out other interfaces. Which is exacly what I need for these devices.

But if there is a better way I really want to know.

[gravenscroft]

Why not filter rules?

Limited criteria. Filter Rules operate at layer 3, so your only available criteria are layer-3 things: IP addresses, ports, interfaces. If you want to create the rule using something like a hostname, username, &c., you have to use the Firewall app.

If you're just using an IP address, Filter Rules are definitely preferable.

[bokolobs]

Thanks for your replies. I created two rules in Filter Rules and they're working as intended. I used source IP address and destination interface set to the tunnel for the allow rule and then a block rule from same source IP to any WAN.