Re: PSA: Simple Wi-Fi gateway killswitch that works with OpenVPN config files

The killswitch works by deleting the Wi-Fi default gateway:

    0.0.0.0    0.0.0.0    192.168.1.1

No gateway means no internet unless the VPN is active. 
If the VPN drops, the system becomes isolated. 
This worked perfectly with my old USB Wi-Fi dongle.

Then I installed a modern internal Wi-Fi NIC, and everything fell apart.
Why?

Apparently, modern Wi-Fi cards are "smart".
Old USB Wi-Fi dongles are "dumb".
This difference matters.

With the old USB Wi-Fi dongle:
 a. It did not report a gateway
 b. It did not support NCSI
 c. It did not auto-repair routes
 d. It did not push metrics
 e. It did not renew DHCP leases
 f. OpenVPN could not detect a ROUTE_GATEWAY
 g. Windows did not try to fix anything

With the USB dongle, when the killswitch deleted the gateway, it stayed deleted. 
 a. OpenVPN did not re-add it.
 b. Windows did not re-add it. 
 c. When I "broke" the network, it stayed broken.

With the new internal Wi-Fi card:
 a. It reports a valid gateway (192.168.1.1)
 b. It supports NCSI and auto-metric
 c. It performs DHCP lease renewal
 d. It auto-repairs missing routes
 e. OpenVPN now sees a gateway and re-adds it

So the sequence became:
1. Killswitch deletes the gateway
2. Windows silently restores it
3. OpenVPN also restores it
4. Killswitch fails

Both Windows and OpenVPN were being "helpful" and that broke the killswitch 
that we all had worked on together, five years ago, to get it working.

So what was the simple solution? 
1. Configure Wi-Fi with a static IP and NO gateway:
   C:\> netsh interface ipv4 set address name="Wi-Fi 2" static 192.168.1.20 255.255.255.0 none
   This prevents Windows from auto-repairing the route.

2. Set a very high interface metric:
   C:\> netsh interface ipv4 set interface "Wi-Fi 2" metric=9999
   This prevents Windows from preferring Wi-Fi over VPN routes.

3. Block OpenVPN from re-adding the gateway by adding this to your .ovpn file:
    pull-filter ignore "redirect-gateway"
   This stops OpenVPN from injecting the default route.

4. Detect the gateway using the routing table (not WMIC):
   C:\> route print | find "0.0.0.0" | find "%defgw%"
   WMIC is deprecated and unreliable on modern Windows.

5. Run the killswitch via a scheduled task so route changes have admin privileges.

The bottom line is that if your killswitch suddenly stops working 
after upgrading your Wi-Fi hardware, it might not be in your script. 
It may be your NIC is being too helpful in restoring the gateway
moments after you remove it.

Modern Wi-Fi cards actively repair missing gateways and give OpenVPN 
enough information to re-add them. Older USB dongles did not.

Switch to:
 a. static IP
 b. no gateway
 c. high metric
 d. pull-filter ignore "redirect-gateway"
 e. routing-table detection

Your killswitch will work again exactly as intended.

Note that you need elevated privileges to modify the routing table.
So the target of the taskbar icon is a scheduled task, e.g.,
  C:\Windows\System32\schtasks.exe /run /TN "task nettoggle"

That task runs the batch script I will append after this article.
-- 
Usenet is where people with vast knowledge converge to discuss ideas.