I want to add a VPN kill switch to my router. The problem is that most of the examples I've seen shut down access to the WAN port.

This is my setup:

modem -> |router1 (open)| Router1.LAN -> Router2.WAN -> |router2 (vpn)|

Router1 is connected to the modem and offers open access. There is a cable from a LAN port on Router1 to the WAN port on Router2. Router2 is running a VPN client.

This is what I have now on Router2:

iptables -I FORWARD -i br0 -o `nvram get wan_iface` -j DROP

It works as a kill switch, but prevents all access to Router1 from Router2. I want to be able to access devices on Router1 from Router2.

Does anyone have any other ideas?

1 Answer 1


You need to block that port in the FORWARD rules.

iptables -A FORWARD -p tcp -i br0 -d <destination_ip> --dport <1234> -j DROP

This tells iptables to drop packets going to destination_ip at port 1234, where the VPN server is running. You will have to determine the destination ip and port. Also confirm that the protocol is TCP and not UDP, or you will have to modify that too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .