How to set up a VPN kill switch"

[kzlz]

I’m creating a VPN gateway VM using a Debian template, protonvpn, opnevpn. but I would like to know how to set up a VPN kill switch.

[apparatus]

ProtonVPN App 4.2 setup guide

Intro This guide explains how to setup a a VPN with ProtonVPN app on Qubes OS 4.2 using a Fedora template. A cool thing with ProtonVPN is that they have a Free offer, although it comes with limitations it’s nice. They seem also a legit service to use as per the trustable source Private VPN Service Recommendations and Comparison, No Sponsors or Ads - Privacy Guides If you want to set up a ProtonVPN using WireGuard without the App, see Wireguard VPN setup Setup Qube creation Create a dedicate…

[solene]

Thanks @apparatus

That guide only explain how to prevent traffic to be forwarded if the VPN is not up, but from within the qube, this is practical when using the VPN provider App because you can’t guess the IP : PORTS for the firewall. The drawback is that the qube itself is able to remove the killswitch if it’s compromised (or if you mess with nftables rules)

The only killswitch that will block the traffic for sure, but requires to know the VPN endpoint IP and port, is this one (it’s a direct link to the killswitch section)

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support, most of them do, but you can also add your own if you have a server. ProtonVPN has a free plan, it has limits but gives you a fully working VPN and they support WireGuard. This pro…

[kzlz]

qvm-firewall sys-vpn add accept dsthost=1.2.3.4 # (2)

Should the IP address remain as 1.2.3.4, or should it be changed to the IP address of the sys-vpn qube? Or should it be the IP address of the ProtonVPN server?

Use the Qube GUI to set the firewall to the VPN endpoint (this avoids leaks)

It seems that setting the endpoint’s IP here is not having any effect at all. Could this be due to the configuration of sys-whonix in sys-vpn on netqube?