There are probably multiple ways. You could configure your Linux firewall to only allow the VPN interface for all destinations different from your LAN or you could make sure the default gateway is set to a VPN IP in the route config.
this post was submitted on 18 May 2024
22 points (92.3% liked)
linux4noobs
980 readers
1 users here now
linux4noobs
Noob Friendly, Expert Enabling
Whether you're a seasoned pro or the noobiest of noobs, you've found the right place for Linux support and information. With a dedication to supporting free and open source software, this community aims to ensure Linux fits your needs and works for you. From troubleshooting to tutorials, practical tips, news and more, all aspects of Linux are warmly welcomed. Join a community of like-minded enthusiasts and professionals driving Linux's ongoing evolution.
Seeking Support?
- Mention your Linux distro and relevant system details.
- Describe what you've tried so far.
- Share your solution even if you found it yourself.
- Do not delete your post. This allows other people to see possible solutions if they have a similar problem.
- Properly format any scripts, code, logs, or error messages.
- Be mindful to omit any sensitive information such as usernames, passwords, IP addresses, etc.
Community Rules
- Keep discussions respectful and amiable. This community is a space where individuals may freely inquire, exchange thoughts, express viewpoints, and extend help without encountering belittlement. We were all a noob at one point. Differing opinions and ideas is a normal part of discourse, but it must remain civil. Offenders will be warned and/or removed.
- Posts must be Linux oriented
- Spam or affiliate links will not be tolerated.
founded 1 year ago
MODERATORS
Do you have any recommendations on guides how to do the former? I saw posts like this AskUbuntu post but they use the .ovpn files instead of the Mullvad client from my understanding.
If you're on XFCE, you can import the .ovpn files really easily. Right-click the network icon and choose "Edit connections" (You can also go there by going to Advanced Network Configurations). Then click the plus sigh at the bottom left of the window and choose "Import a Saved VPN Configuration" in the dropdown menu that appears. Click "Continue" and you'll be able to pick the .ovpn file wherever you might have saved it.
This option right here, in Plasma network settings.
Would that option work with the Mullvad client though or would I need to setup the ovpn files and what not?
I can check the box to allow it but right now the option to select a connection (to the right) is greyed out.
You need to set up a separate vpn connection in the same window, then you link that VPN connection to your WiFi or Ethernet connection using the option above.
If the system cannot initialize vpn connection, the WiFi connection will also fail.
You will need .ovpn file, you can download it from Mullvad website.
Turning off WiFi is technically a solution. You won’t connect to WiFi without using a VPN. 🙃
May I ask, how I can accomplish this?
I've tried with systemd service file, but I don't know yet how. Is there better solution?
I want to stop interface on shutdown, sleep and hibernate.
Not sure about how to automate it, but you could probably just flip the switch in the system tray. You could also tie it to a power profile.
I wasn’t really being serious with this reply. Your post seems to suggest you want to prevent wifi connection until a VPN connection is established. My suggestion was just to turn off wifi altogether due to some wordplay allowed from the title.
I will figure it out somehow
I need another service to stop on connection lose (e.g slow internet), any idea how?
Qubes is the best solution/architecture for this.
You can set something with network name spaces and default routes that reduce possible exposure to direct internet routing, but unless its enforced at some higher level (like through VMs) then there is a risk.
You can use a external vpn device like openwrt as your uplink.
Depending on how much control you have of your network, you can make the default vlan of your computer non-internet routable, and only mullvad can talk to a vlan with direct internet access. (so if something spins up your network stack, it wont route to the internet)
At your router/gateway apply firewall rules such that ONLY the vpn endpoint is routable (either from the whole network, or just that computer, or just that vlan, etc)
iptables -I OUTPUT -o $NIC_IF ! -d $VPN_REMOTE -j DROP