Re: PSA: Simple Wi-Fi gateway killswitch that works with OpenVPN config files

Maria Sophia <[email protected]> Fri, 17 Jul 2026 14:17:49 -0400
Newsgroups alt.comp.os.windows-10,alt.comp.os.windows-11,alt.comp.microsoft.windows
Organization BWH Usenet Archive (https://usenet.blueworldhosting.com)
Message-ID <[email protected]>
Maria Sophia wrote:
> PSA: Simple Wi-Fi gateway killswitch that works with OpenVPN config files

Drat. I ran a comprehensive set of tests with this nettest.bat script, and
it turned out that I needed to *remove* the openvpn directive I had added.

So that others can benefit, here's the script that added the directive to,
oh, maybe a few thousand free openvpn config files I've gathered over time.

  @echo off
  :: add_pull-filter-ignore.bat
  setlocal enabledelayedexpansion
  
  :: This will use current working directory where the script is run
  set "config_dir=%~dp0"
  :: This will use whatever directory you specify to run the script in
  REM set config_dir="C:\tmp\vpn\0\test"
  
  echo Updating .ovpn files in: %config_dir
  echo.
  
  for %%F in (%config_dir%\*.ovpn) do (
      echo Appending to: %%~nxF
      call :append_lines "%%F"
  )
  
  echo.
  echo Done. All .ovpn files updated.
  pause
  exit /b
  
  :: Subroutine for appending settings
  :append_lines
  >>%1 echo.
  >>%1 echo pull-filter ignore "redirect-gateway" ; Do not let server set gateway
  exit /b
  
  
And here's the script that removed that added directive, when I found out
not only was it not needed, but it was causing VPN to not correctly work.

  :: remove_pull-filter-ignore.bat
  :: Remove the pull-filter line so VPN can set redirect-gateway again.
  :: This fixes the problem where the killswitch accidentally blocked the VPN
  :: from becoming the default route. See notes below for future reference.
  @echo off
  setlocal
  
  
  set "dir=C:\tmp\vpn\0\config"
  
  echo Removing pull-filter ignore "redirect-gateway" from all .ovpn
files...
  echo.
  
  for %%f in ("%dir%\*.ovpn") do (
      powershell -Command ^
          "(Get-Content '%%f') | Where-Object { $_ -notmatch 'pull-filter
ignore \"redirect-gateway\"' } | Set-Content '%%f'"
      echo Cleaned: %%~nxf
  )
  
  echo.
  echo Done. All configs updated.
  pause
  endlocal
  
  
-- 
I avoid complex solutions when a leaner one already solves known issues.