You can use custom kernel filter on Windows and iptables/netfilter on Linux to allow only one process to access physical interface. I've seen Cisco VPN Client (

You can use custom kernel filter on Windows and iptables/netfilter on Linux to allow only one process to access physical interface. I've seen Cisco VPN Client (10 years ago or so) do it - apart from CVPND service, all traffic to/from ethernet was dropped. That included kernel stuff - to the point your PC didn't even respond to ARP packets from anything other than gateway. Of course, introducing custom kernel driver and/or your own mini IP stack is way harder to do in a safe way - that's why it's not usually included. As for Linux solutions - I haven't seen VPN client that used this technique, but I guess it's a lot easier, since all the required userland tools are already there.