Re: PSA: Simple Wi-Fi gateway killswitch that works with OpenVPN config files

Maria Sophia wrote:
> Note that you need elevated privileges to modify the routing table.
> So the target of the taskbar icon is a scheduled task, e.g.,
>   C:\Windows\System32\schtasks.exe /run /TN "task nettoggle"
> 
> That task runs the batch script I will append after this article.

Here is the script written today to fix the problem that both Windows and
OpenVPN were being "too helpful" in repairing when I removed the gateway.

  :: nettoggle.bat
  :: v1p3 20260715
  ::
  ::  This nettoggle.bat killswitch only works when there is no gateway, 
  ::  by default. This killswitch is what adds and removes the gateway
  ::  a. Windows is not allowed to add/remove the gateway on its own
  ::  b. The VPN server is not allowed to add/remove the gateway on its own
  :: 
  :: Logic:
  :: 1. When you tap the tasbar icon, check if the default route exists;
  :: 2. If it exists, delete it; if it does not exist, add it 
  ::
  :: For VPN, we need this directive:
  ::  pull-filter ignore "redirect-gateway" ; VPN server can't change gateway
  :: For Windows, we need to remove the gateway from the default setup:
  ::  netsh interface ipv4 set address name="Wi-Fi 2" static 192.168.1.20 255.255.255.0 none
  ::  
  :: This logic is simple, reliable, and does not depend on WMIC, netsh
  :: parsing, or interface-specific quirks. It works with modern Windows
  :: network stacks and full-featured Wi-Fi cards.
  :: This script provides a simple ON/OFF toggle for the default gateway.
  :: When the gateway exists, the script deletes it.
  :: When the gateway is missing, the script adds it back.
  :: The toggle is activated by clicking a taskbar shortcut that runs a
  :: scheduled task with highest privileges. Running the batch file
  :: directly in a normal CMD window will NOT work because route changes
  :: require elevated privileges.
  ::
  :: Earlier versions prior to v1p3 used WMIC to detect the current gateway. 
  :: WMIC is now deprecated and (supposedly) unreliable in Windows 10. 
  ::
  :: Hence, the v1p3 script does NOT use WMIC. Instead, it checks the routing
  :: table directly. The routing table is the source of truth for whether
  :: the system has a default route. This method is reliable and does not
  :: depend on interface names, DHCP state, or WMIC formatting.
  ::
  :: The default route 0.0.0.0 determines whether the system has a path to
  :: the internet. Removing this route blocks all non-VPN traffic. Adding
  :: it back restores normal internet access. The VPN supplies its own
  :: route when active, so removing the local default route does not break
  :: the VPN. If the VPN later drops, the system has no fallback route,
  :: which creates a killswitch effect.
  ::
  :: The problem with DHCP is that Windows will recreate the default gateway 
  :: automatically if DHCP is enabled. To prevent this, the Wi-Fi interface 
  :: must be configured with a static IP address and no gateway. 
  :: This ensures that Windows does not auto-repair the route after deletion.
  ::
  :: The Wi-Fi interface metric is set to a high value (9999) to prevent
  :: Windows from preferring it over VPN routes. This avoids automatic
  :: route injection and keeps the killswitch stable.
  ::
  :: The route command requires elevated privileges. Running the batch file
  :: directly from a normal CMD window will not modify the routing table.
  :: The scheduled task is configured to run with admin privileges 
  :: but without a UAC prompt.
  ::
  :: --------------------------------------------------------------------
  @echo off
  setlocal
  
  :: Set to your router IP address
  set defgw=192.168.1.1
  
  :: Check if default route exists
  route print | find "0.0.0.0" | find "%defgw%" >nul
  
  if not errorlevel 1 (
      :: Route to the gateway exists, remove it 
      route delete 0.0.0.0 %defgw%
  ) else (
      :: Route to the gateway is missing, add it
      route add 0.0.0.0 mask 0.0.0.0 %defgw%
  )
  
  endlocal
  exit
  
 -- 
Usenet allows kind intelligent good-hearted people to help each other out.