Thanks for taking the time to reply. It seems like this would be worth a write-up!
Perhaps something like this can be scripted; if it becomes polished enough it could be recommended as a part of every VPN setup.
Perhaps something like this can be scripted; if it becomes polished enough it could be recommended as a part of every VPN setup.
But. It's basically what I described. For public VPN network, just use the default (all output, only established input). For private LAN, deny all output and input, and allow output to selected IP addresses (VPN and DNS servers).