VPN and Kill Switch

VPN and Kill Switch

Bull can route a VM's traffic through OpenVPN or WireGuard and enforce a kill switch so that nothing leaves the machine outside the tunnel. If the VPN drops, traffic stops — no accidental clear-net leaks during an engagement.

sudo bull vpn <vm-name> <config-file>

The VM must be running.

Type detection

Bull figures out the VPN type from the config:

• It first looks at the extension (.ovpn, .conf, .wg, .wgconf).
• It then inspects the contents: a [Interface] (and [Peer]) section means WireGuard; client / remote / proto / dev directives mean OpenVPN.

If it cannot decide, it stops with an error rather than guessing.

What happens on the VM

1. The config is copied into the VM's directory on the host and uploaded to /tmp inside the VM.
2. Bull installs the right client (openvpn or wireguard) non-interactively.
3. OpenVPN: the config is placed at /etc/openvpn/client/client.conf and started via openvpn-client@client (enabled on boot).
4. WireGuard: the config is placed at /etc/wireguard/wg0.conf (chmod 600) and started via wg-quick@wg0 (enabled on boot).
5. The kill switch is applied.
6. The inventory marks the VM as vpn_configured.

The kill switch

The kill switch is a set of iptables rules, persisted across reboots via iptables-persistent:

• Default policies: INPUT ACCEPT, OUTPUT DROP, FORWARD DROP.
• Allow loopback in and out.
• Allow the VPN interface (tun0 for OpenVPN, wg0 for WireGuard) in and out.
• Allow RFC 1918 LAN ranges (10/8, 172.16/12, 192.168/16) so Vagrant SSH and management keep working.
• Allow established/related connections.
• Save rules to /etc/iptables/rules.v4 and via netfilter-persistent.

The generated script is also saved on the host at <vm-dir>/vpn/killswitch.sh for reference.

The net effect: with the tunnel up, traffic flows. If the tunnel drops, the default OUTPUT DROP policy blocks everything except loopback and LAN management, so no traffic escapes over the clear net.

Verifying

After configuring, connect and check the exit IP:

sudo bull connect <vm-name>
curl ifconfig.me        # should be the VPN exit IP, not your real one

Bull also ships an internal verification routine that checks for a tun0/wg0 interface, reports the external IP, and shows the active DNS server (a quick DNS-leak sanity check).

Notes and limits

• The LAN allow-rules are deliberate: they keep Vagrant's SSH management channel alive. They also mean traffic to private ranges is not forced through the VPN.
• The kill switch protects against the VPN process dying. It is not a substitute for verifying your provider's no-log claims or for application-level leak protection.
• If kill-switch setup fails, Bull leaves the VPN configured and warns you, rather than aborting the whole operation.