OpenWrt VPN Kill Switch

A kill switch stops your devices from using the normal internet connection when the VPN is down. On OpenWrt you do not need extra software: the firewall's zones already decide where LAN traffic may go.

This assumes you followed the WireGuard client guide, so you have a vpn interface in a vpn firewall zone and a lan → vpn forwarding.

How it works

The default configuration allows forwarding from lan to wan. If you remove that forwarding, LAN devices can only reach the internet through the vpn zone. When the tunnel is down, their traffic has nowhere to go and is dropped.

The router itself still uses WAN, which it needs to re-establish the tunnel.

1. Remove the LAN → WAN forwarding

In LuCI: Network → Firewall, edit the lan zone and remove wan from Allow forward to destination zones (keep vpn). Save & Apply.

Over SSH, find the forwarding first:

uci show firewall | grep forwarding

Look for the section with src='lan' and dest='wan' (in the default configuration it is @forwarding[0]), then delete it:

uci delete firewall.@forwarding[0]
uci commit firewall
service firewall restart

2. Prevent DNS leaks

With the forwarding removed, LAN devices still ask the router for DNS, and the router forwards the queries to its upstream servers. Make sure those are the VPN's DNS servers, reached through the tunnel (step 4 of the WireGuard guide): disable peerdns on WAN and set the provider's DNS on the vpn interface.

3. Test it

1. On a LAN device, confirm an IP-check site shows the VPN location.
2. Stop the tunnel: ifdown vpn.
3. Websites should stop loading on LAN devices.
4. Bring it back: ifup vpn.

Exceptions

To let a specific device bypass the VPN (for example a games console), use policy-based routing together with a dedicated forwarding rule, rather than restoring lan → wan for everyone.