I have Debian 7.1 machine with a wifi access point and openvpn installed. It's connected through LAN cable to the internet and has a wifi access point.

I'm trying to set up a wifi ap where I'm sure everything gets only through the VPN.
In more detail:
- clients on that wifi can only reach the internet through VPN
- if ovpn connection breaks, no internet connection through that wifi should be possible
- besides the connected wifi clients, nothing should go through the ovpn, not even on the debian machine itself.

What would be the best way to do this? Is this possible with iptables or do you have better ideas?

Thank you