VPN Killswitch

RouterOS General
1

I have Policy Based Routing set up on my Mikrotik to Mangle certain packets and send those to a VPN connection using Routing Marks.

The problem I have though, is that if the VPN disconnects, these packets will end up on the unencrypted link (failover to the default route)
My intent however, is to completely drop VPN packets if the VPN link is disconnected and avoid failover to the default route to prevent traffic on an unencrypted connection unbeknownst to the user.

/ip firewall mangle
add action=mark-connection chain=input connection-mark=no-mark in-interface=capped new-connection-mark=capped passthrough=yes
add action=mark-routing chain=output connection-mark=capped new-routing-mark=capped passthrough=no
add action=mark-connection chain=input connection-mark=no-mark in-interface=PureVPN new-connection-mark=PureVPN passthrough=yes
add action=mark-routing chain=output connection-mark=PureVPN new-routing-mark=PureVPN passthrough=no
add action=mark-routing chain=prerouting comment="First Mark All Packets" new-routing-mark=capped passthrough=yes src-address=192.168.1.0/24
add action=mark-routing chain=prerouting comment="Afterwards, add exceptions for other routing marks. 192.168.1.15 goes via VPN Tunnel" new-routing-mark=PureVPN passthrough=yes port=!80,443 protocol=tcp src-address=192.168.1.15

/ip route
add check-gateway=ping comment="DEFAULT ROUTE" distance=1 gateway=capped scope=255
add check-gateway=ping distance=2 gateway=capped routing-mark=capped
add check-gateway=ping distance=2 gateway=PureVPN routing-mark=PureVPN

Any suggestions on how I can achieve this?

2

Hi

You should add a blackhole route to your route table as last entry, so it wouldn’t fallback into main route table.

add distance=10 routing-mark=PureVPN type=blackhole
3

Exactly what I needed, thanks!
Wasn’t aware of the blackhole capability

Appreciate the help

4

I used to do this in firewall, but routing makes it even simpler. Thanks for the hint.
I use type=unreachable, though.

5

what I did for my kill switch on the client was to activate the nat only to the range of addresses of the tuner, only to mask everything that comes out through the VPN and a static route, 0.0.0.0 gateway L2TP Distance 1, when the VPN fails it stays without internet the router