+1 I have it set to deny everything except openvpn, Captive Network Assistant and UserEventAgent on all networks by default. Only explicitly whitelisted netwo

+1 I have it set to deny everything except openvpn, Captive Network Assistant and UserEventAgent on all networks by default. Only explicitly whitelisted networks have access beyond these three rules. On an untrusted network (the default state), you can still connect to public wifi (using the Captive Network Assistant and UserEventAgent), and once connected to the insecure wifi, connect to the secure VPN. The VPN connection is whitelisted, so once it has connected to VPN everything starts flowing again. As soon as I disconnect from the VPN no traffic goes in or out. Couldn't imagine using public wifi at airports, or coffee shops without it now.