VPN-Kill-Switch — Lecks blockieren, wenn der Tunnel abbricht

#!/usr/sbin/nft -f
# s4m kill-switch: drop all output unless it goes through the s4m tunnel.
flush ruleset
table inet s4m_ks {
  chain out {
    type filter hook output priority 0; policy drop;
    oifname "lo" accept
    oifname "wg0" accept                         # s4m WireGuard interface
    ip daddr <WG_ENDPOINT_IP> udp dport 51820 accept  # handshake to s4m
    ct state established,related accept
    meta nfproto ipv6 drop                        # kill IPv6 leaks (exit is IPv4)
  }
}
# apply:  sudo nft -f s4m-killswitch.nft     revert: sudo nft flush ruleset

# /etc/pf.s4m.conf   —  load:  sudo pfctl -f /etc/pf.s4m.conf -e
set block-policy drop
block out all
pass out on lo0 all
pass out on utun3 all                      # your s4m WireGuard interface
pass out proto udp to <WG_ENDPOINT_IP> port 51820   # handshake
block out inet6 all                        # kill IPv6 leaks
# disable:  sudo pfctl -d

# Block all outbound, then allow only the s4m WireGuard adapter + handshake.
New-NetFirewallRule -DisplayName "s4m-ks-block" -Direction Outbound -Action Block -Enabled True
New-NetFirewallRule -DisplayName "s4m-ks-allow-wg" -Direction Outbound -Action Allow -InterfaceAlias "s4m" -Enabled True
New-NetFirewallRule -DisplayName "s4m-ks-handshake" -Direction Outbound -Action Allow -Protocol UDP -RemoteAddress <WG_ENDPOINT_IP> -RemotePort 51820 -Enabled True
# Stop IPv6 leaks:
Disable-NetAdapterBinding -Name "*" -ComponentID ms_tcpip6
# Remove later:  Get-NetFirewallRule -DisplayName "s4m-ks-*" | Remove-NetFirewallRule