I am running EndeavorOS with XFCE 4 and am using Mullvad as my VPN. To be clear I know Mullvad’s client has a lockdown and kill switch mode but it seems like after updating it my PC is connecting to the internet without it. I could be mistaken but I don’t think it’s blocking anything at that point. I would likely have to wait until the next Mullvad update to test this for sure though. If someone can either confirm or deny my suspicions I would greatly appreciate it because I wouldn’t have to find another work around.

All that said if that is the case, how can I prevent my PC from connecting to the internet when Mullvad is not running?

Maybe there’s a simple option like binding the network manager to mullvad client application? Ideally I’d like to avoid either not using their client and using some thrown-together update script like

#!/bin/bash

xfce4-terminal --command=“sudo pacman -Syu”;

/opt/Mullvad VPN/mullvad-vpn";

Edit: Maybe it is connecting after the update but not showing the GUI. I came across this post on GitHub

I have a Mullvad desktop app set to launch on start-up. Also “Start minimized” is set to false. At the system start-up I get connected to the VPN, so the Mullvad daemon apparently starts, but no application window launches. I have to launch it manually.

I did not check to see if this was happening after I updated.

  • @jetAEnglish
    1•1 month ago

    Qubes is the best solution/architecture for this.

    You can set something with network name spaces and default routes that reduce possible exposure to direct internet routing, but unless its enforced at some higher level (like through VMs) then there is a risk.

    You can use a external vpn device like openwrt as your uplink.

    Depending on how much control you have of your network, you can make the default vlan of your computer non-internet routable, and only mullvad can talk to a vlan with direct internet access. (so if something spins up your network stack, it wont route to the internet)

    At your router/gateway apply firewall rules such that ONLY the vpn endpoint is routable (either from the whole network, or just that computer, or just that vlan, etc)