Do linux users need a "kill switch"?

[go558a83nk 362]

The only linux I've used for VPN is that on my router and it has its own coding to manage policy routing and block clients if the VPN tunnel is down...

 

I don't know if the following is a real problem, especially for those who use the Eddie client.  However, I thought I'd share.

 

https://zorrovpn.com/articles/linux-iptables-vpn-only

 

which leads into the manpage for the script they've made

 

The script is free to share and edit under GNU GPL.

 

There is a section dealing with allowing access (of course) to VPN server IP.  By default that section is geared towards zorrovpn since they are the maker.  However, I'm sure it can be edited by somebody who knows what they are doing to work for Air.

[rickjames 106]

The air client already uses iptables if the option is chosen. It also rewrites or rename/replaces the resolv.conf - dns option depending.

 

There's a rule set posted here that's similar.

https://airvpn.org/topic/9139-prevent-leaks-with-linux-iptables/

Its not stateful but by simply adding the if not '!' eth+ ! -d it really doesn't need to be. -Unless someone try's to spoof the ip.

[go558a83nk 362]

The air client already uses iptables if the option is chosen. It also rewrites or rename/replaces the resolv.conf - dns option depending.

 

There's a rule set posted here that's similar.

https://airvpn.org/topic/9139-prevent-leaks-with-linux-iptables/

Its not stateful but by simply adding the if not '!' eth+ ! -d it really doesn't need to be. -Unless someone try's to spoof the ip.

 

right, iptable usage to block whatever is certainly not novel.  but, looks like zorro is trying to make it easier for people to manage automatically with their script.

[rickjames 106]

 

The air client already uses iptables if the option is chosen. It also rewrites or rename/replaces the resolv.conf - dns option depending.

 

There's a rule set posted here that's similar.

https://airvpn.org/topic/9139-prevent-leaks-with-linux-iptables/

Its not stateful but by simply adding the if not '!' eth+ ! -d it really doesn't need to be. -Unless someone try's to spoof the ip.

 

right, iptable usage to block whatever is certainly not novel.  but, looks like zorro is trying to make it easier for people to manage automatically with their script.

 

What I meant was on linux when using the eddie client you can just go to the settings and turn on the lock option. That does the same or more than what that script is doing. So Eddie client users don't need the script as it has one built in

 

A modded version of that script might be good for newer linux users that are unable to run the client though.