I have a separate computer exclusively for VPN usage. How do I ensure internet does NOT work without VPN? (I don't want to rely on Kill Switch)

VPN Forum
1

I have a computer, and every single thing over this computer has to go through VPN.

But I have other devices (phones and laptops) that shouldn’t be connected to VPN. So, not looking for a new router.

How do I ensure that the computer dedicated for VPN does NOT work without VPN?

I mean to say, I want to remove the connectivity options to internet without VPN.

I don’t want to rely on Kill Switch alone.

For now, I’m using the computer with Wi-Fi, but will soon move to Ethernet connection.

Thanks in advance!

2

Add one of their dns entries to the network adapter properties. That way websites won’t display unless connected

3

You can buy special purpose mini-PCs and install OPSense on them to act as a dedicated, external VPN box that sits between your computer and your existing router/switch or modem/internet service provider. Your computer will not even know it is communicating with the internet through a VPN tunnel. Because you’re setting up your VPN traffic as a NAT rule, OPSense cannot send traffic outside of the VPN tunnel, regardless if the VPN servers are up or down.

Example, of mini-PC: https://www.aliexpress.com/item/1005005535612244.html

There are tons of similar PCs with a vast array of specs and capabilities.

Then install OPSense and setup WireGuard and NAT: https://0x2142.com/how-to-protect-your-home-network-with-mullvad-vpn-opnsense/

Note that OPSense is not meant to be a software switch. If you want more than one device to go through this VPN box/router, you will also need a normal network switch.

You can put this VPN box between your computer and your existing router/switch/modem, and that way you can have only the computer go through VPN (without even knowing) and everything else not go through the VPN.

PS. If performance/bandwidth is important, you need a mini-PC with some oumph. For instance, Intel J4125 based machines can only do around 500 mbit/s over WireGuard in OPNsense: https://www.reddit.com/r/OPNsenseFirewall/comments/11vjbl7/j4125_with_intel_225_wireguard_performance/

Newer chips such as N100 have around twice the performance of J4125, so they should be able to go faster: https://www.cpu-monkey.com/en/compare_cpu-intel_celeron_j4125-vs-intel_processor_n100

4

This is how I do this.

I place the system on a separate VLAN (configured in my router, you need a good router for this). Then, on that VLAN I block every IP address using the firewall rules except for the IP address of the VPN server. Voila, I have a safety net, only my VPN’s IP address can be reached. It has worked well for me for a few years now.

5

I believe that’s what lockdown mode does

6

Mullvad’s VPN app, at least for the Mac, has the features, where you can stipulate what apps must go via VPN and you can also set it to prohibit any traffic from going other than via VPN.

7

Awesome! This is exactly what I’m looking for. Thank you!

However, I’m unable to completely understand how to add them to network adapter properties. Do you happen to know any website/video that shows instructions?

So far, what I understand is.

Control Panel > Network connections > right click on Ethernet or WiFi > Properties

I’m lost here. In the list, which items should I select? Where can I add the dns entries?

8

Sure. I’ll do that. But I’m surprised to learn that it’s the only way real IP address is leaked.

So if I do the binding, I’m good even if VPN or internet or anything else fails unexpectedly?

9

But that’s still some form of Kill Switch offered within VPN right?

I read some posts where people got notices despite using these built-in kill switches.

Any thoughts?

10

Here you go boss. You can leave all slots blank except the DNS, it’ll figure the rest out with DHCP when it talks to your router.

11

Follow the next post and let us know

12

Lockdown mode won’t allow your device to connect to internet if the VPN is not connected. Enable VPN on startup also. So it automatically turns on whe. You boot up computer

13

Thank you! I left the option “Obtain IP address automatically”, and added the DNS to 100.64.0.3 (for ad and tracker blocking).

What about IP6? Does it needs changes too? Does it also connect to internet?

(apologies if my question doesn’t make sense, I don’t know much about these things).

By the way, I still didn’t get the VPN. I wanted to gain knowledge and I’ll subscribe once I know how to activate all the settings… Hopefully by end of today!!

14

I did most of the process. Now I’m with DNS entries.

The website has all list of DNS entries - except for “Vanilla” (without any blocking).

I want to use it as alternate DNS. I can’t find the DNS entry “Vanilla” for zero blocking.

And for some reason I’m unable to open the link mentioned right before “Vanilla”.

Do you know the DNS entry of the zero blocking vanilla?

15

Thanks a lot! I read not to completely rely on Kill Switch, but never understood the reasoning behind it.

Thanks for making it clear!!

16

You can just set ipv6 to static but just put nonsense into it. This would prevent the PC from ever trying to use ipv6.

Outside of massive companies you only really see ipv4, so getting rid of it like this is a benefit.

(Most equipment SUPPORTS ipv6, but doesn’t use it, to be clear lol)

Edit: also for quick information on these subjects I really suggest TechQuickie (YouTube) as they give quick summaries that are easily understood by a layperson.

17 
Hostname 	        IPv4 address 	IPv6 address 	DoH port  DoT port
dns.mullvad.net 	194.242.2.2 	2a07:e340::2 	443 	  853
18

I just set the IPv6 address to 2001:0:0:0:0:0:0:0, subnet prefix to 2.

I hope nothing of that sort exists indeed for internet to connect lol. If it does, please let me know, and I’ll create some other random number.

So if I understand it right, here’s the entire cycle.

  1. Get a VPN and activate “Lockdown Mode” (this is from VPN software side).
  2. Network connections > Properties (ethernet/wifi) > IPv6 to dummy values… IPv4 > Obtain IP address automatically > Use the following DNS server > Preferred > 100.64.0.3 (for Ad & tracker blocking)

By doing the above 2, there’s no way for internet to be connected to anything on PC - unless it’s connected to VPN + the DNS server.

Am I right?

What happens if the VPN is disconnected? Would the internet still be connected to 100.64.0.3 without VPN thereby exposing my actual info?

Thanks a lot!

19

Thanks again! I’m so glad I waited to ask the question here before doing anything. I’ll surely look for the binding and follow the instructions.

Have a wonderful day!

20

You’ve basically got it yeah! You should also put in a secondary DNS , and both 100.64.0.3 & the other DNS need to be for your specific VPN.

Test connecting without a VPN to make sure the DNS(s) isn’t publicly forwarded as well (which would cause your network to work, just providing you the DNS features of ad / tracker blocking)