Yeah there are a bunch of tools like this - I'm using Aviatrix at the moment for a bunch of hosts: * Incoming access is allowed to "stuff" when connected to th

Yeah there are a bunch of tools like this - I'm using Aviatrix at the moment for a bunch of hosts: * Incoming access is allowed to "stuff" when connected to the OpenVPN host. * Outgoing access to services is very heavily restricted. * Outgoing HTTP/HTTPS requires the site to be on an allow-list. By default all outgoing HTTP/HTTPS traffic is denied. (We might add yum-repositories to the allowlist, or permit access to the various "Windows Updates" services, for example. But all other downloads from remote sites would be denied.)