OpenWrt kill switch, DNS and IPv6

What you get

Protected devices stop, rather than falling back to your normal connection, whenever the tunnel is not carrying them. Name lookups from protected devices go through ForestVPN, and IPv6 from them is carried or refused, never sent around the tunnel. You also get a test that shows it.

Before you start

• Device: an OpenWrt router with ForestVPN installed and protection on, see first run.
• Know: the kill switch has two halves that fail independently. A routing half sends protected devices into a table whose only ways out are the tunnel or nowhere, and no firewall reload touches it. A firewall half is written as ordinary OpenWrt firewall configuration, so the firewall rebuilds it itself on every reload. Neither half depends on the ForestVPN program being alive.
• Time: ten minutes, plus the test.
• What can break: the kill switch is never absolute. It covers the devices ForestVPN protects, not the router's own traffic and not devices on Direct.

Steps

1. Choose the level on the last setup screen, or later on the status page.

   • Standard: protected devices have no internet until ForestVPN is back. They use your normal connection, unprotected, when you pause or sign out, when your plan's limit is reached, when this version is no longer accepted, when ForestVPN cannot start, and after a firmware upgrade until ForestVPN is installed again. Nothing on the device shows this. A banner at the top of the status page says protection is off.
   • Strict: protected devices never use your normal connection.

   The kill switch is armed from the first successful connect after setup, and stays armed across reboots. A reboot, an update in progress, a control plane that cannot be reached and an exit-side cut are not releases.

2. Know the two ways out. Pause protection is for a hotel or public Wi-Fi sign-in page: it needs the router's administrator password, and while paused protected devices use the router's normal name lookups so the page can load. Resume protection re-arms within about 10 seconds.

3. Name lookups. Lookups from protected devices are sent to the tunnel's resolver, over IPv4. A lookup that still reaches the router is refused at once, and a device that asked over IPv6 asks again over IPv4. DNS over TLS (port 853) is refused for protected devices. The router's own name still resolves for blocked devices, so you can open the status page. Unprotected devices and the router keep using the router's normal resolver.

4. IPv6. On OpenWrt with the nftables firewall (fw4, from 22.03), IPv6 from protected devices goes into the tunnel when the tunnel has an IPv6 address, and is refused at once when it has none. Some locations have no IPv6, so devices fall back to IPv4 quickly. On OpenWrt 21.02 (fw3) the firewall cannot translate IPv6 or tell protected devices apart, so while protection is on the whole LAN's forwarded IPv6 is refused at the router, never sent to the WAN.

5. Run the test from a protected device when nobody needs the internet. First open a what-is-my-address page and a DNS leak test. Then stop the program on the router. The service manager starts it again within seconds.

   Kills the ForestVPN program to test the block

   kill -9 $(pidof fv)

Check it worked

While the program is down, a protected device has no internet and a device on Direct still does. Once it is back, the address page and the DNS test on a protected device show only the location's address and resolver, and no IPv6 address of your home. While it is down the status page reads Reconnecting: "Protected devices have no internet until ForestVPN is back."

Shows the rules that hold the block

ip rule show

ForestVPN's two rules are listed while protection is on, whether or not the program runs.

Undo it

Press Pause protection on the status page, or press Turn off protection on the same page. To remove ForestVPN altogether see updates, firmware upgrades and uninstall.

If something is wrong

Limits

• The router's own traffic never enters the tunnel, and a device on Direct is never blocked.
• Under Standard, protected devices go direct in the cases listed in step 1, and only Strict never sends a protected device direct.
• A browser that does its own secure DNS cannot be caught by the router.
• Port forwarding does not work through the tunnel.