[innocent21]

I did not make this tutorial.
How to prevent computer from accessing internet if your VPN crash.

OK this is really small thing,but this thing can save you ass BIG TIME,there were few times when my VPN crashed and my real net was pinging all websites while it was reconnecting,and this is VERY VERY BAD thing,or some other software leaks or whatever,its big mess.I didn't write this myself,enjoy and be safe.

To make long story short and reasons for using Comodo Firewall behind, let me get straight to the topic.

Now everyone is using VPN these days, no matter what It is PPTP, L2TP, OpenVPN or anything else. The problem occurs when connection is dropped and you're fully exposed. In order to prevent that kind of a situation you need to completely block all non-VPN traffic using firewall (Comodo in this case, but works with any other firewall as well). You've got to create the following global rule by doing the following:

Comodo Firewall -> Firewall -> Network Security Policy -> Global Rules -> Add

Action: Block
Protocol: IP
Direction: In/Out
Source Address: Network Zone - (You Internet Access zone, ex. home #1)
Destination Address: Exclude - IPv4 Single Address - Entry address of server

Now the Entry address of server would be the remote IP of the VPN server you're connecting to. OpenVPN for example will reflect that IP in *.ovpn config file under "remote" string.

Small, but highly important add-on to your security.

[FunkyG]

Thanks! That'll probably save my ass some day

[neko.py]

Note that the ProtonVPN windows client has this built in. There's an option called VPN Kill Switch or Network Kill Switch, which supposedly cuts your network if you disconnect

[phyrrus9]

Another option would be to set your network up to depend on such a VPN. Here is a guide on how to set up L2L on a cisco router. If you do it properly, if the VPN link disconnects, the router won't have a route, and all traffic will fail. You can also set this up by VLAN if you also have a managed switch, so that some physical ports in your house are routed through the VPN and others are straight through. This is very useful if you have work computers or servers that need to be internal. You simply set up a link on the router, use subinterface routing to manage the VLAN, and put all of those devices on that VLAN. If something changes in your VPN, you only have to change it on the router and all the devices will be effected. No need to have VPN software or config on the local machines, they can't tell the difference.

[neko.py]

All this talk about routers and such, but i think a good iptables or firewalld setup could accomplish this

[phyrrus9]

All this talk about routers and such, but i think a good iptables or firewalld setup could accomplish this

I wasn't talking about firewalls, but the router itself. Bear in mind that these are only routers, they aren't firewall appliances or wifi access points or web servers or whatever else consumer grade white box routers do today