up vote 0 down vote favorite
share [g+] share [fb]

I'm using Mac OS and connect to a VPN to hide my location and IP (I have the 'send all traffic over VPN connection' box checked in teh Network system pref), I wish to remain anonymous and do not wish to reveal my actual IP, hence the VPN. I have a prefpan called pearportVPN that automatically connects me to my VPN when I get online. The problem is, when I connect to the internet using Airport (or other means) I have a few seconds of unsecured internet connection before my Mac logs onto my VPN. Therefore its only a matter of time before I inadvertently expose my real IP address in the few seconds it takes between when I connect to the internet and when I log onto my VPN.

Is there any way I can block any traffic to and from my Mac that does not go through my VPN, so that nothing can connect unless I'm logged onto my VPN? I suspect I would need to find a third party app that would block all traffic except through the Server Address, perhaps Intego Virus Barrier X6 or little snitch, but I'm afraid I'm not sure which is right or how to configure them.

Any help would be much appreciated. Thanks!

link|improve this question
Ever heard of a Firewall? – SpacemanSpiff Dec 26 '10 at 17:45
Of course I have, Tom, its clearly eluded to the statement above. The question is which one and how to configure it? Apple's built in firewall does not seem particularly useful in this regards, which is why I suggested Intego Virus Barrier and little snitch. In light of your comment, I'll be more specific: Would a third party firewall (like Virusbarrier or little snitch, etc) or Apple's built in firewall be effective in blocking non-VPN traffic? If so, how can one configure a firewall in such a way to deny non-VPN traffic from a Mac? – John Dec 27 '10 at 0:07
If you're going to revise the question you're better off editing the actual question rather than leaving the revisions in a comment...more people will see the additional information that way. – larsks Dec 27 '10 at 1:20
feedback

migrated from serverfault.com Dec 27 '10 at 2:00

This question came from our site for system administrators and desktop support professionals.

1 Answer

up vote 2 down vote

You would use a firewall to (a) restrict all outbound network traffic other than traffic destined for your VPN server, and then (b) permit any traffic over your VPN interface. The restrictions in (a) would have to include allowances for negotiating a DHCP lease, unless you're using static addressing.

You should be able to accomplish this using the "ipfw" utility from the command line. The firewall available via the "Security" preference pane (new in OS X 10.5, I think) won't allow you to block outbound traffic.

Basic information about ipfw can be found in the FreeBSD handbook.

Once you come up with an appropriate firewall script, you would need to arrange for it to become active when your system starts up. The man pages on launchd, launchctl, and launchd.plist may all be helpful.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard