Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There is a computer connecting to a VPN. The network should remain offline, if the machine can't reconnect to the VPN. It should not ever use the normal connection. Only the VPN one.

Is there a way to set this behaviour up?
The machine is used locally, so there is no need to reach it from the network or anything.

Client OS: Windows 7 Professional x64 SP1

share|improve this question
    
Is there any chance you might use this machine inside a VM? If that's the case, I find it virtually fool proof to install a VPN on the host OS and bridge the network adapter created by the VPN software with the guest OS. I've tried this using VPNGate and I was very pleased with the results. This also lets you chain multiple VPNs and also use Tor (if you're into that kind of thing) –  Vinayak Jun 12 at 15:38

3 Answers 3

up vote 3 down vote accepted

This can be achieved by configuring a firewall to allow only connections to the VPN provider's IP and/or the TCP port 1723 and the UDP port 47.

If you're using several VPN providers, port-based blocking is easier. If not, IP-based blocking is more secure. In any case, you can use both.

For example, you can configure Windows Firewall to do this:

  1. Let's assume you're using superfreevpn.com (69.60.121.29).

  2. Connect to the Internet and your VPN.

  3. Press Win + R and execute control /name Microsoft.NetworkandSharingCenter.

  4. In View your active connections, click the link Home/Work/Public Network below your Internet connection and choose Public network.

  5. In View your active connections, click the link Home/Work/Public Network below your VPN connection and choose Work network.

  6. Press Win + R and execute WF.msc.

  7. In Windows Firewall with Advanced Security on Local Computer, click Action, then Properties, go to the Private Profile tab and set the following:

    Firewall state:        On (recommended)
    Inbound connections:   Block all connections
    Outbound connnections: Allow (default)
    
  8. Port-based

    • In Outbound Rules, click Action, then New Rule... and select the following:

      Port
      TCP
         Specific remote ports: 1-1722, 1724-65535
      Block the connection
      Public
      Public TCP
      
    • In Outbound Rules, click Action, then New Rule... and select the following:

      Port
      UDP 
          Specific remote ports: 1-46, 48-65535
      Block the connection
      Public
      UDP
      

    IP-based

    • In Outbound Rules, click Action, then New Rule... and select the following:

      Custom
      All programs
      Any
      Any IP address
      These IP adresses
          Add
              This IP address range -> From: 0.0.0.0      To: 69.60.121.28
          Add
              This IP address range -> From: 69.60.121.30 To: 255.255.255.255
      Block the connection
      Public
      Non-VPN
      
  9. Since we've blocked all non-VPN DNS queries now, superfreevpn.com won't get resolved.

    Either modify your VPN connection by replacing the hostname by its IP, or add the following line to %windir%\system32\drivers\etc\hosts:

    69.60.121.29    superfreevpn.com
    

Loosely adapted from How to configure firewall such that when VPN disconnects, all browsing stops.

share|improve this answer
    
Dennis, you should be a supermod here. :) –  Shiki Aug 1 '12 at 15:45
    
+1 Thanks, that worked for me, except I think the second "from" address should be From: 69.60.121.30 (ie. VPN server address + 1). –  E M Mar 12 '13 at 15:55
    
@E M: Good point. Fixed. –  Dennis Mar 12 '13 at 15:58

A slight addition to the excellent answer by Dennis: if your Internet connection is configured to use DHCP (as most are) you will not be able to get an IP address unless you exclude the DHCP server address and the broadcast address 255.255.255.255.

Run ipconfig /all (while DHCP still works) to find the address of your DHCP server. Let's say it's 192.168.2.1 and the VPN server is 69.60.121.29, as in Dennis's example. You would then configure blocking for the following IP ranges:

From 0.0.0.0      to 69.60.121.28
From 69.60.121.30 to 192.168.1.255
From 192.168.2.2  to 255.255.255.254

As a temporary workaround you could also disable the outbound firewall rule that blocks everything. That's handy if you've already "lost" your IP address and don't know the address of your DHCP server.

(Credit to Marcks Thomas for the original answer. I'm just adding it to this question in case other users run into the same problem.)

Another, unrelated addition: it may be a good idea to disable network discovery and file and printer sharing for Home/Work networks if you follow the steps above, given that you've configured the entire Internet as your "Work" network. You can do this under Network and Sharing Centre, Change advanced sharing settings.

share|improve this answer

Alternative answer - using routes

You can remove the default route via your real Internet connection and add a route only to the VPN server. This is simpler than Windows Firewall in a way, but there is a catch: Windows will re-add the default route whenever it connects to a network. You can get around that using Task Scheduler to make your changes whenever it connects.

A nice bonus is that you can also automatically connect to the VPN whenever you connect to a network, providing you've got the username and password saved.

First create a batch file like this:

@ECHO OFF

REM IP address of the real gateway you use to connect to the Internet
SET REAL_GATEWAY_IP=192.168.2.1

REM (External) IP address of the VPN server
SET VPN_SERVER_IP=69.60.121.29

REM Delete default route via the real gateway
route delete 0.0.0.0 %REAL_GATEWAY_IP%

REM Add a route to the VPN server via the real gateway
route add %VPN_SERVER_IP% mask 255.255.255.255 %REAL_GATEWAY_IP% metric 1

REM To connect to the VPN (optional):
rasphone -d "My VPN connection name"

Then add a scheduled task in Task Scheduler to run the batch file with the trigger configured like this:

Task trigger configuration

You may also want to uncheck "Start the task only if the computer is on AC power" on the Conditions tab and select "Run whether user is logged on or not" on the General tab.

The routes should then be updated whenever you connect to a network and you can verify them by running route print - there should be no route to 0.0.0.0 via the real gateway.

share|improve this answer
    
Tricky but nice! –  Shiki Mar 27 '13 at 12:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.