Testing the kill switch
A kill switch is only worth something once it has been seen to hold. Each test watched the WAN port with tcpdump while traffic was forced to look for a way out.
Results#
| Test | Result |
|---|---|
| Tunnel interface taken down | The default route stayed on the tunnel, marked unusable. Web, ping and DNS all failed, and nothing but the tunnel's own error replies left the WAN port. |
| Leak counter after that test | Zero block_wan_leak events: routing alone held, and pf never had to step in. |
| A ping from the firewall forced into the WAN's table | Blocked by pf, logged as block_wan_leak, and the alert fired. |
| The provider's own connection check | Using the VPN, no DNS leaks, no WebRTC leaks. |
| A phone on the guest network | The provider's address, as intended; its connections leave on the WAN port. |
In the configuration#
#!/bin/sh
# Run every minute from cron. Logs at daemon.err, which the SIEM alerts on,
# when the last WireGuard handshake is older than max_age (default 180 s).
max=${1:-180}
age=$(/sbin/ifconfig wg0 2>/dev/null | sed -n 's/.*last handshake: \([0-9][0-9]*\) seconds ago.*/\1/p')
if [ -z "$age" ] || [ "$age" -gt "$max" ]; then
/usr/bin/logger -t wg-check -p daemon.err "tunnel wg0 DOWN (last handshake: ${age:-never} s ago)"
fiwg-check 0forces the message, which is how the alert itself was tested.