Create a manual kill switch or VPN firewall for GNU/Linux to prevent any leaks including but not limited to DNS leaks outside VPN network at all by completely denying Internet access on a given system without an active encrypted PrivateVPN connection.

Note: Other online guides might suggest you to allow DNS queries via your default gateway but I don’t recommend it. So, if you wish to allow it, you are at liberty to do so.

For the purpose of this guide I am going to use PrivateVPN’s OpenVPN-TUN-UDP server in Chennai, India bearing an IP address: 169.38.69.24.

In order to find out the IP address of VPN gateway, open https://privatevpn.com/serverlist/ and copy a server’s hostname from Server Address column. Use host command in a terminal window followed by the hostname. Syntax for host command in this case would be:

For the purpose of this guide I am going to use wlp6s0 as network interface.

In order to find out your Internet facing network interface name use route command. Keep in mind it requires root or sudo access. Syntax for route command would be:

Open .ovpn configuration file in a text editor, look for remote option and replace the hostname or servername therein with IP address as seen in the image below:

Let’s roll.

Majority of GNU/Linux users either use iptables or ufw to manage their firewall. We have written separate sections for both tools below for your convenience.

(Note: You are advised to backup your current iptables ruleset with iptables-save)

iptables ruleset is already written for you. Here take a look:

Above iptable rule set expunges every pre-exiting rule set in iptables and outrightly drops every outgoing connection other than to PrivateVPN OpenVPN server’s IP in India that to at a particular port (port 1194) using a specific protocol (udp). Also all incoming and outgoing connections are allowed over virtual network interface tun0 exclusively.

You can copy iptables rule set from above and save it as iptables-ks.sh for your convenience to edit/execute them.

In order to activate iptables rule set in iptables-ks.sh for deploying a Kill switch, open a terminal with root/sudo rights and do as follows:

Congrats! Your VPN kill switch or firewall is active.

These settings are temporary and would be wiped upon reboot. In order to prevent it you might need to install “iptables-persistent” package for your distribution.

Or set it to run on boot by adding this line to the end of /etc/crontab:

(Note: We recommend you to backup your current firewall ruleset.)

I already wrote ufw ruleset for you. Here take a look:

You can copy the ufw rules from above and save it as ufw-ks.sh for your convenience to edit/execute them.

Open a terminal and gain sudo access or root access and do as follows:

Congrats! Your VPN kill switch or firewall is active.

You can add multiple-servers in the same kill switch script. Just add additional lines for that particular server too.

For example these two lines to above mentioned ufw-ks.sh would also allow connection to Icelandic server other than Indian VPN server:

Thanks for reading! Enjoy!