Firewall restore and VPN kill switch

johnyjj2 · 05-26-2015, 02:18 AM

Hello,

I would like to use kill switch feature for VPN in Ubuntu, i.e. to make it possible to access Internet only when I am connected to VPN and deny any access when I am without VPN.

I have followed steps here (https://www.privateinternetaccess.co...-ubuntu#Item_1), i.e. executed all the commands that begin with sudo in this one answer (replacing X.X.X.X with my VPN address and tun0 with wlan0), there were no errors in terminal but these settings don't work correctly.

When I have these rules enabled (sudo ufw enable) I cannot connect to VPN at all. There are also problems with correctly accessing websites outside VPN. How should I modify these commands?

The second question is how can I restore original settings? Before applying these commands I could connect to VPN normally, now I need to disable ufw before doing that. I have tried removing ufw and iptables with "sudo apt-get remove" and then installing them again with "sudo apt-get install" but I have impression that it does not restore firewall settings to default.

Thanks in advance!

johnyjj2 · 05-27-2015, 05:24 PM

What else can I check to make it working? I have noticed that one issue was that I have written name.of.my.vpn instead of providing its IP address (even if I add "sudo ufw allow out 53 # dns queries" it does not help). So after changing my VPN PPTP settings to IP address, the connection to VPN fails but after several seconds (earlier it was failing immediately). Still there is something missing in my rules.

I have checked ufw logs in /var/log/syslog and I can see the following difference between successful (after "sudo ufw reset") and unsuccessful (after applying rules) connection to VPN. There is timeout because it cannot sent control packet I think.

Code:

May 27 23:09:59 my-computer-name pptp[21137]: nm-pptp-service-21129 log[main:pptp.c:314]: The synchronous pptp option is NOT activated
May 27 23:10:15 my-computer-name pptp[21074]: nm-pptp-service-21064 warn[open_inetsock:pptp_callmgr.c:329]: connect: Connection timed out

Code:

May 27 23:14:33 my-computer-name pptp[21406]: nm-pptp-service-21398 log[main:pptp.c:314]: The synchronous pptp option is NOT activated
May 27 23:14:33 my-computer-name pptp[21420]: nm-pptp-service-21398 log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 1 'Start-Control-Connection-Request'

What should I change in these firewall rules?

Thanks in advance!