Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is a computer connecting to a VPN. The network should remain offline, if the machine can't reconnect to the VPN. It should not ever use the normal connection. Only the VPN one.

Is there a way to set this behaviour up?
The machine is used locally, so there is no need to reach it from the network or anything.

Client OS: Windows 7 Professional x64 SP1

share|improve this question
Is there any chance you might use this machine inside a VM? If that's the case, I find it virtually fool proof to install a VPN on the host OS and bridge the network adapter created by the VPN software with the guest OS. I've tried this using VPNGate and I was very pleased with the results. This also lets you chain multiple VPNs and also use Tor (if you're into that kind of thing) – Vinayak Jun 12 '14 at 15:38
up vote 3 down vote accepted

This can be achieved by configuring a firewall to allow only connections to the VPN provider's IP and/or the TCP port 1723 and the UDP port 47.

If you're using several VPN providers, port-based blocking is easier. If not, IP-based blocking is more secure. In any case, you can use both.

For example, you can configure Windows Firewall to do this:

  1. Let's assume you're using (

  2. Connect to the Internet and your VPN.

  3. Press Win + R and execute control /name Microsoft.NetworkandSharingCenter.

  4. In View your active connections, click the link Home/Work/Public Network below your Internet connection and choose Public network.

  5. In View your active connections, click the link Home/Work/Public Network below your VPN connection and choose Work network.

  6. Press Win + R and execute WF.msc.

  7. In Windows Firewall with Advanced Security on Local Computer, click Action, then Properties, go to the Private Profile tab and set the following:

    Firewall state:        On (recommended)
    Inbound connections:   Block all connections
    Outbound connnections: Allow (default)
  8. Port-based

    • In Outbound Rules, click Action, then New Rule... and select the following:

         Specific remote ports: 1-1722, 1724-65535
      Block the connection
      Public TCP
    • In Outbound Rules, click Action, then New Rule... and select the following:

          Specific remote ports: 1-46, 48-65535
      Block the connection


    • In Outbound Rules, click Action, then New Rule... and select the following:

      All programs
      Any IP address
      These IP adresses
              This IP address range -> From:      To:
              This IP address range -> From: To:
      Block the connection
  9. Since we've blocked all non-VPN DNS queries now, won't get resolved.

    Either modify your VPN connection by replacing the hostname by its IP, or add the following line to %windir%\system32\drivers\etc\hosts:

Loosely adapted from How to configure firewall such that when VPN disconnects, all browsing stops.

share|improve this answer
Dennis, you should be a supermod here. :) – Shiki Aug 1 '12 at 15:45
+1 Thanks, that worked for me, except I think the second "from" address should be From: (ie. VPN server address + 1). – EM0 Mar 12 '13 at 15:55
@E M: Good point. Fixed. – Dennis Mar 12 '13 at 15:58

A slight addition to the excellent answer by Dennis: if your Internet connection is configured to use DHCP (as most are) you will not be able to get an IP address unless you exclude the DHCP server address and the broadcast address

Run ipconfig /all (while DHCP still works) to find the address of your DHCP server. Let's say it's and the VPN server is, as in Dennis's example. You would then configure blocking for the following IP ranges:

From      to
From to
From  to

As a temporary workaround you could also disable the outbound firewall rule that blocks everything. That's handy if you've already "lost" your IP address and don't know the address of your DHCP server.

(Credit to Marcks Thomas for the original answer. I'm just adding it to this question in case other users run into the same problem.)

Another, unrelated addition: it may be a good idea to disable network discovery and file and printer sharing for Home/Work networks if you follow the steps above, given that you've configured the entire Internet as your "Work" network. You can do this under Network and Sharing Centre, Change advanced sharing settings.

share|improve this answer

Alternative answer - using routes

You can remove the default route via your real Internet connection and add a route only to the VPN server. This is simpler than Windows Firewall in a way, but there is a catch: Windows will re-add the default route whenever it connects to a network. You can get around that using Task Scheduler to make your changes whenever it connects.

A nice bonus is that you can also automatically connect to the VPN whenever you connect to a network, providing you've got the username and password saved.

First create a batch file like this:


REM IP address of the real gateway you use to connect to the Internet

REM (External) IP address of the VPN server

REM Delete default route via the real gateway
route delete %REAL_GATEWAY_IP%

REM Add a route to the VPN server via the real gateway
route add %VPN_SERVER_IP% mask %REAL_GATEWAY_IP% metric 1

REM To connect to the VPN (optional):
rasphone -d "My VPN connection name"

Then add a scheduled task in Task Scheduler to run the batch file with the trigger configured like this:

Task trigger configuration

You may also want to uncheck "Start the task only if the computer is on AC power" on the Conditions tab and select "Run whether user is logged on or not" on the General tab.

The routes should then be updated whenever you connect to a network and you can verify them by running route print - there should be no route to via the real gateway.

share|improve this answer
Tricky but nice! – Shiki Mar 27 '13 at 12:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .