Problems setting up iptables killswitch

[Tom_Doyle]

Hi,

@MarchHare

Also add a sudo infront of the nano /etc/systemd/system/openvpn@.service for others trying to do the same

Done

@MarchHare

After stopping the service curl times out:

Just to confirm, it is working when the vpn service is running?

@MarchHare

@Tom_Doyle Is this what was expected as a result? Could I block the resolv?

Yes with the current iptable rules, this is the expected result. As for blocking the the resolv, remove these iptables rules:
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 53 -j ACCEPT

@MarchHare edit: dilthedog has just pointed out that the suggestion of removing these iptable rules, will prevent the vpn from coming up; as PIA uses a domain name rather than an ip address for the config.

I suggest changing the nameserver ip addresses, in /etc/resolv.conf to PIAs:

209.222.18.222 and 209.222.18.218

This of course means openresolv and the addtions to the vpn conf are no-longer required.

@MarchHare

Also how do I save the iptables so they won’t be removed on reboot.

sudo apt-get install iptables-persistent
sudo netfilter-persistent save
sudo systemctl enable netfilter-persistent

Thanks Tom.