Is there a way to stop network access until openvpn has connected?
None that I’m aware of, in a practical sense. What’s the reason for the question?
The OS must first start up before processes like openvpn can start. You could physically disconnect the ethernet cable and then physically reconnect it later and in the meantime have iptables block all kinds of outbound access until openvpn starts up but, really, is that practical?
A practical solution is to have two boxes or VMs. One is the gateway running the VPN and the other is the client that sends all its traffic through the gateway.
Just that it updates all addons before vpn is connected.
By any reasonable interpretation, you want to prevent general network access until openvpn has connected to the network. By this I assumed you wanted all network traffic to pass through the VPN. This does not square with your next post:
since addons could not be updated until the VPN is connected.
So which is it?
All traffic to go via VPN as when kodi starts all addons update before the vpn connects
I want no traffic until vpn has connected. Openelec has wait for network which works great but prefer osmc.
Realistically, I don’t think that’s possible with a single-machine solution. You need to allow networking to be up before starting an openvpn client, though it’s not strictly necessary for an openvpn server, AFAIK.
Wait for network is a standard part of systemd. It means only run process X once the network is up.
The bottom line is this: at system startup, there is going to be a certain amount of network traffic leaving your OSMC box before openvpn has had a chance to kick in. If you want to avoid this entirely, you need a VPN gateway between your OSMC box and the outside world that is already running when you start OSMC. Another Raspberry Pi would work.
So does OSMC.
We even have an option for this in My OSMC.
This however is the best approach.