It’s a best practice to use VPN when you connect to public Wi-Fi networks. However, in the scenarios I am aware of, you first connect to the network and only then—after connected—switch to VPN. In that case there is time-window when your traffic goes on an insecure connection and you are vulnerable.

My concern is many programs/services/processes running on a PC execute a housekeeping/update check/status check as soon as a network connection is available. And all those activities would be performed via an insecure connection if they are triggered before the switch to the VPN connection.

Is it possible to avoid this?

  • This is a non-issue because VPN connection will be encrypted from your client connection to the VPN anyway. Simply connecting to a public Wi-Fi network in and of itself won’t expose anything. – JakeGould Apr 4 '15 at 15:02
  • 1
    Yes it does: many programs/services/processes running on your pc execute housekeeping/update check/status check as soon as a network connection is available. And all those activities will be performed on insecure connection until you switch to VPN. – peterfoldi Apr 4 '15 at 15:14
  • Very fair reason and concern. I just edited your question to add that info since it clarifies the whole concern in my mind. – JakeGould Apr 4 '15 at 15:19
  • @peterfoldi: You beat me by 75 seconds! – G-Man Aug 16 '15 at 16:47
  • Use superuser.com/questions/262799/… to remove default route (route delete on, add route (route add) to VPN network going through default gateway so you allow VPN to establish. Let VPN connection give you default route to – ssnobody Aug 18 '15 at 0:36

How you do this specifically depends on what OS you use and what firewall you use. The general rule is to set your firewall to block connections by default so nothing can access the internet at all, then manually add the required rules for the VPN to work.

In Windows for example, the built-in firewall rules can be changed to default block on outbound on a per profile basis. If you do this on the Public profile, then nothing can access the internet. Then, create an allow rule for your VPN client software, so nothing can access the internet other than the VPn client. Finally, either assign the VPN to a private profile or add additional rules to allow outbound access through the VPN interface alone.

On Linux for example, it is very similar, setting the default outbound rule to 'DROP' in iptables, add a specific allow rule to your VPN server, and then adding a specific allow rule for all outbound traffic via the VPN adapter.


It would take some time and effort on your part to do the set up, but if you are concerned enough about the security risk arising from automatic updates, then you can use your Firewall to block application access.

This post gives you the details on how to do this for Windows 7, but most firewalls have a similar concept where you can control the inflow and outflow to your computer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.