> And netns is for single-host isolation. This is a router forwarding LAN→WAN. Different problem Not at all. Put the LAN interface in a network namespace tha

> And netns is for single-host isolation. This is a router forwarding LAN→WAN. Different problem Not at all. Put the LAN interface in a network namespace that is different to the host (ip link set ... netns ...). This gives you your "kill switch" without even needing firewall rules, it happens on a lower level.