UFW: force traffic thru OpenVPN tunnel / do not leak any traffic
- by hotzen
I have VPN access using OpenVPN and try to create a safe machine that does not leak traffic over non-VPN interfaces.
Using the firewall UFW I try to achieve the following:
Allow Access from LAN to the machine's web-interface
Otherwise only allow Traffic on tun0 (OpenVPN-Tunnel interface when established)
Reject (or forward?) any traffic over other interfaces
Currently I am using the following rules (sudo ufw status):
To Action From
-- ------ ----
192.168.42.11 9999/tcp ALLOW Anywhere # allow web-interface
Anywhere on tun0 ALLOW Anywhere # out only thru tun0
Anywhere ALLOW OUT Anywhere on tun0 # in only thru tun0
My problem is that the machine is initially not able to establish the OpenVPN-connection since only tun0 is allowed, which is not yet established (chicken-egg-problem)
How do I allow creating the OpenVPN connection and from this point onward force every single packet to go thru the VPN-tunnel?