This is a must read if you're interested in non-standard Linux networking: http://lartc.org/lartc.html http://lartc.org/lartc.html Look for "Split access", it'

This is a must read if you're interested in non-standard Linux networking: http://lartc.org/lartc.html http://lartc.org/lartc.html Look for "Split access", it's pretty similar to what you're talking about. Basically you'd just send all your traffic on your default routes table to 127.0.0.1 (nowhere), and all the traffic on your VPN routes table to the VPN. That way when the VPN isn't active all your traffic gets blackhole'd, when your VPN is active it'll all get sent over the encrypted tunnel though.