Couple Questions about OpenVPN

[AsusRouterUser]

I am wondering if there is a way to have all traffic go out the VPN and if the VPN goes down not to allow any traffic out (in other words not roll to the "regular" internet connection). But what I really would like to know is if there is a way to have only certain IP address go out the VPN and if the VPN goes down not allow those and only those IP address to not have any connection until the VPN is back up.

Any help with is would be greatly appreciated.
Thanks, AsusRouterUser

 

[CaptainSTX]

I am wondering if there is a way to have all traffic go out the VPN and if the VPN goes down not to allow any traffic out (in other words not roll to the "regular" internet connection). But what I really would like to know is if there is a way to have only certain IP address go out the VPN and if the VPN goes down not allow those and only those IP address to not have any connection until the VPN is back up.

Any help with is would be greatly appreciated.
Thanks, AsusRouterUser

If you upgrade/switch to Merlin's enhanced firmware on your ASUS router then what you want to do can easily be accomplished through the GUI. With the stock firmware on an ASUs router not possible or at least easily possible.

 

[ColinTaylor]

https://github.com/RMerl/asuswrt-merlin.ng/wiki/Policy-based-routing

"Block routed clients if tunnel goes down"

 

[bertradio]

https://github.com/RMerl/asuswrt-merlin.ng/wiki/Policy-based-routing

"Block routed clients if tunnel goes down"

I have that setup and it works like a charm.

One wrinkle/feature to keep in mind. If you have both a regular wifi network and a guest network the IP addresses assigned to a client will be different depending on which wifi network is being used. If you have devices which are used on both nets then you would need to include both IP addresses in the policies. On the other hand if you have devices where you want access both with and without VPN, you could only assign only one of the IP addresses and switch wifi SSID's on the device to choose whether you want connectivity with or without the VPN.

The ability to do all this is one of the main reasons I use Merlin instead of the stock firmware.