"One massive problem with personal VPN services is that they are working to fail open. If the connection fails, your connection is not “protected” anymore. Some

"One massive problem with personal VPN services is that they are working to fail open. If the connection fails, your connection is not “protected” anymore. Some premium VPN providers sell “kill switch” functionality, but I am sure less than 1% of the users use this properly." There's a very, very easy way to solve this problem: vpn_command ; ip link set ens160 down ... or whatever ... this way, if the VPN exits you are immediately bringing your network down. Very simple and robust. A 'network slug'[1] is an even more robust - and network-wide - mechanism for enforcing your VPN. If you are serious about avoiding misconfiguration or opsec failures you should have a network slug as a physical choke in your PHY. [1] A "slug" is a layer-2 bridge, with no IP address configured, that still enforces a TCP/IP whitelist. So it does not "use" a hop on the network route, and you can't see the device, but as it bridges traffic it enforces a (very simple) ruleset: https://john.kozubik.com/pub/NetworkSlug/tip.html https://john.kozubik.com/pub/NetworkSlug/tip.html