ddwrt-ovpn-client-killswitch.sh

#!/bin/sh
DEBUG=; set -x # uncomment/comment to enable/disable debug mode

#          name: ddwrt-ovpn-client-killswitch.sh
#       version: 1.0.2, 24-jul-2022, by eibgrad
#       purpose: block access LAN->WAN for gui openvpn client (pbr and non-pbr)
#   script type: wanup (autostart)
#  installation:
#    1. enable jffs2 (administration->jffs2)
#    2. enable syslogd (services->services->system log)
#    3. use shell (telnet/ssh) to execute one of the following commands:
#         curl -kLs bit.ly/ddwrt-installer|tr -d '\r'|sh -s -- TKdKUmY1 wanup
#       or
#         wget -qO - bit.ly/ddwrt-installer|tr -d '\r'|sh -s -- TKdKUmY1 wanup
#    4. (optional): use vi editor to modify options:
#         vi /jffs/etc/config/ddwrt-ovpn-client-killswitch.wanup
#    5. reboot
#   limitations:
#    - this script is NOT compatible w/ the ddwrt-ovpn-split-basic.sh or
#      ddwrt-ovpn-split-advanced.sh scripts
#    - changes to the openvpn client or this script will only be recognized
#      upon reboot or reinitialization of the WAN

# ------------------------------ BEGIN OPTIONS ------------------------------- #

VPN_ENABLED_ONLY='1' # 0: apply rules 24/7, 1: apply rules only if VPN enabled

# state checking: "state NEW" vs. no state
#   state NEW (default):
#     * any pre-existing LAN->WAN connections persist until/unless they
#       timeout/close
#     * remote access (WAN->LAN) is allowed (provided port forwarding is enabled)
#     * more efficient (only LAN->WAN packets used to establish NEW connections
#       are inspected)
#   no state:
#     * any pre-existing LAN->WAN connections are stopped/blocked
#     * remote access (WAN->LAN) is denied (even if port forwarding is enabled)
#     * less efficient (every LAN->WAN packet is inspected)
{
FW_STATE='-m state --state NEW'
#FW_STATE='' # uncomment/comment to disable/enable state checking

# ------------------------------- END OPTIONS -------------------------------- #

# ---------------------- DO NOT CHANGE BELOW THIS LINE ----------------------- #

WAN_IF="$(ip route | awk '/^default/{print $NF}')"
FW_CHAIN='ovpn-block-lan2wan'

# cleanup from possible prior execution
{
iptables -D FORWARD -o $WAN_IF $FW_STATE -j REJECT
iptables -D FORWARD -o $WAN_IF $FW_STATE -j $FW_CHAIN
iptables -F $FW_CHAIN
iptables -X $FW_CHAIN
} >/dev/null 2>&1

# quit if vpn disabled (unless firewall rules still need to be enforced)
[[ "$(nvram get openvpncl_enable)" == '0' && "$VPN_ENABLED_ONLY" != '0' ]] && exit 0

# block *all* if nothing in policy based routing
if [ ! "$(nvram get openvpncl_route)" ]; then
    iptables -I FORWARD -o $WAN_IF $FW_STATE -j REJECT
    exit 0
fi

# create firewall chain for blocked ip(s)/network(s)
iptables -N $FW_CHAIN

# read ip/network addresses from openvpn client policy based routing
echo -e "$(nvram get openvpncl_route)" | \
    while read ip; do
        ip="${ip//$'\r'}" # remove carriage returns

        # block access LAN->WAN for this ip/network address
        [ "$ip" ] && iptables -A $FW_CHAIN -s "$ip" -j REJECT
    done

# begin blocking: force LAN->WAN traffic thru firewall chain for inspection
iptables -I FORWARD -o $WAN_IF $FW_STATE -j $FW_CHAIN

exit 0

} 2>&1 | logger -p user.$([ ${DEBUG+x} ] && echo 'debug' || echo 'notice') \
    -t $(echo $(basename $0) | grep -Eo '^.{0,23}')[$$]