Re: PSA: Simple Wi-Fi gateway killswitch that works with OpenVPN config files

Maria Sophia wrote:
> PSA: Simple Wi-Fi gateway killswitch that works with OpenVPN config files

Discouraging news... 

I just learned the hard way that if you completely disable IPv6, 
the entire strategy of this network gateway toggle falls apart.
 netsh interface ipv6 set teredo disabled
 netsh interface ipv6 set 6to4 disabled (deprecated on my Win10Pro box)
 netsh interface ipv6 set isatap disabled (deprecated on my Win10Pro box)
 reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xFF /f

You have to only partially disable IPv6 if you want this method to work.

This old LiquidVPN killswitch methodology relies on
 a. A static IPv4 address
 b. No IPv4 gateway
 c. A predictable default route
 d. Windows not trying to fix connectivity
The kill switch depends on the default route being static.
However, after fully disabling IPv6, Windows made it dynamic.

What happened is after fully disabling IPv6, Windows thrashed wildly
when I ran the killswitch, and since the only thing I had changed 
was I completely removed IPv6, it was easy to determine the cause.

Without IPv6, the nettoggle methodology broke because Windows
 a. Removes the default route
 b. Adds a temporary default route
 c. Removes it again
 d. Recalculates interface metrics
 e. Re-adds a default route through the VPN
 f. Re-adds a default route through Wi-Fi
 g. Removes both
 h. Re-adds one
 i. Re-adds the other
 j. Re-adds a link-local IPv6 route (even though IPv6 is disabled)

I observed all this route thrashing in real time after instrumenting
the script with simple popup messages like the following modification:
  @echo off
  setlocal
  
  :: Set to your router IP address
  set defgw=192.168.1.1
  
  :: Check if default route exists
  route print | find "0.0.0.0" | find "%defgw%" >nul
  set routeExists=%errorlevel%
  
  if %routeExists%==0 (
      :: Route to the gateway exists, remove it
      route delete 0.0.0.0 %defgw%
      msg * "Default route DISABLED"
  ) else (
      :: Add a delay to account for NCSI connectivity checks, 
      :: DHCP discovery attempts (even though DHCP is disabled) 
      :: and route validation (all of which can cause a bounce). 
      timeout /t 2 >nul
      :: Route to the gateway is missing, add it
      route add 0.0.0.0 mask 0.0.0.0 %defgw%
      msg * "Default route ENABLED"
  )
  
  endlocal
  exit

The script expects the route print to return stable results:
  route print | find "0.0.0.0" | find "192.168.1.1"
But with IPv6 completely removed, Windows was adding/removing default 
routes every few seconds, which made the killswitch unpredictable.

But with IPv6 completely removed, the kill switch was no longer
toggling a stable route.

I'm in the process of more gracefully removing IPv6, but the 
warning here is that we need a better method of building a 
killswitch since Windows tries to repair the route aggressively
the instant we completely remove IPv6 from Windows networking.

 Newsgroups: alt.comp.os.windows-10,alt.comp.microsoft.windows,alt.comp.os.windows-11
 Subject: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?
 Date: Sat, 18 Jul 2026 12:47:22 -0400
 Message-ID: <[email protected]>
-- 
Sometimes, what we should have known all along is only learned later.