6

There is a computer connecting to a VPN. The network should remain offline, if the machine can't reconnect to the VPN. It should not ever use the normal connection. Only the VPN one.

Is there a way to set this behaviour up?
The machine is used locally, so there is no need to reach it from the network or anything.

Client OS: Windows 7 Professional x64 SP1

1
  • Is there any chance you might use this machine inside a VM? If that's the case, I find it virtually fool proof to install a VPN on the host OS and bridge the network adapter created by the VPN software with the guest OS. I've tried this using VPNGate and I was very pleased with the results. This also lets you chain multiple VPNs and also use Tor (if you're into that kind of thing)
    – Vinayak
    Jun 12, 2014 at 15:38

3 Answers 3

4

This can be achieved by configuring a firewall to allow only connections to the VPN provider's IP and/or the TCP port 1723 and the UDP port 47.

If you're using several VPN providers, port-based blocking is easier. If not, IP-based blocking is more secure. In any case, you can use both.

For example, you can configure Windows Firewall to do this:

  1. Let's assume you're using superfreevpn.com (69.60.121.29).

  2. Connect to the Internet and your VPN.

  3. Press Win + R and execute control /name Microsoft.NetworkandSharingCenter.

  4. In View your active connections, click the link Home/Work/Public Network below your Internet connection and choose Public network.

  5. In View your active connections, click the link Home/Work/Public Network below your VPN connection and choose Work network.

  6. Press Win + R and execute WF.msc.

  7. In Windows Firewall with Advanced Security on Local Computer, click Action, then Properties, go to the Private Profile tab and set the following:

    Firewall state:        On (recommended)
    Inbound connections:   Block all connections
    Outbound connnections: Allow (default)
    
  8. Port-based

    • In Outbound Rules, click Action, then New Rule... and select the following:

      Port
      TCP
         Specific remote ports: 1-1722, 1724-65535
      Block the connection
      Public
      Public TCP
      
    • In Outbound Rules, click Action, then New Rule... and select the following:

      Port
      UDP 
          Specific remote ports: 1-46, 48-65535
      Block the connection
      Public
      UDP
      

    IP-based

    • In Outbound Rules, click Action, then New Rule... and select the following:

      Custom
      All programs
      Any
      Any IP address
      These IP adresses
          Add
              This IP address range -> From: 0.0.0.0      To: 69.60.121.28
          Add
              This IP address range -> From: 69.60.121.30 To: 255.255.255.255
      Block the connection
      Public
      Non-VPN
      
  9. Since we've blocked all non-VPN DNS queries now, superfreevpn.com won't get resolved.

    Either modify your VPN connection by replacing the hostname by its IP, or add the following line to %windir%\system32\drivers\etc\hosts:

    69.60.121.29    superfreevpn.com
    

Loosely adapted from How to configure firewall such that when VPN disconnects, all browsing stops.

3
  • Dennis, you should be a supermod here. :)
    – Apache
    Aug 1, 2012 at 15:45
  • +1 Thanks, that worked for me, except I think the second "from" address should be From: 69.60.121.30 (ie. VPN server address + 1).
    – EM0
    Mar 12, 2013 at 15:55
  • @E M: Good point. Fixed.
    – Dennis
    Mar 12, 2013 at 15:58
3

A slight addition to the excellent answer by Dennis: if your Internet connection is configured to use DHCP (as most are) you will not be able to get an IP address unless you exclude the DHCP server address and the broadcast address 255.255.255.255.

Run ipconfig /all (while DHCP still works) to find the address of your DHCP server. Let's say it's 192.168.2.1 and the VPN server is 69.60.121.29, as in Dennis's example. You would then configure blocking for the following IP ranges:

From 0.0.0.0      to 69.60.121.28
From 69.60.121.30 to 192.168.1.255
From 192.168.2.2  to 255.255.255.254

As a temporary workaround you could also disable the outbound firewall rule that blocks everything. That's handy if you've already "lost" your IP address and don't know the address of your DHCP server.

(Credit to Marcks Thomas for the original answer. I'm just adding it to this question in case other users run into the same problem.)

Another, unrelated addition: it may be a good idea to disable network discovery and file and printer sharing for Home/Work networks if you follow the steps above, given that you've configured the entire Internet as your "Work" network. You can do this under Network and Sharing Centre, Change advanced sharing settings.

1

Alternative answer - using routes

You can remove the default route via your real Internet connection and add a route only to the VPN server. This is simpler than Windows Firewall in a way, but there is a catch: Windows will re-add the default route whenever it connects to a network. You can get around that using Task Scheduler to make your changes whenever it connects.

A nice bonus is that you can also automatically connect to the VPN whenever you connect to a network, providing you've got the username and password saved.

First create a batch file like this:

@ECHO OFF

REM IP address of the real gateway you use to connect to the Internet
SET REAL_GATEWAY_IP=192.168.2.1

REM (External) IP address of the VPN server
SET VPN_SERVER_IP=69.60.121.29

REM Delete default route via the real gateway
route delete 0.0.0.0 %REAL_GATEWAY_IP%

REM Add a route to the VPN server via the real gateway
route add %VPN_SERVER_IP% mask 255.255.255.255 %REAL_GATEWAY_IP% metric 1

REM To connect to the VPN (optional):
rasphone -d "My VPN connection name"

Then add a scheduled task in Task Scheduler to run the batch file with the trigger configured like this:

Task trigger configuration

You may also want to uncheck "Start the task only if the computer is on AC power" on the Conditions tab and select "Run whether user is logged on or not" on the General tab.

The routes should then be updated whenever you connect to a network and you can verify them by running route print - there should be no route to 0.0.0.0 via the real gateway.

1
  • Tricky but nice!
    – Apache
    Mar 27, 2013 at 12:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .