How to Use simplewall with VPNs (WireGuard & OpenVPN)

Combining a virtual private network (VPN) with simplewall provides dual-layer security: the VPN encrypts all packet payloads across the internet, while simplewall ensures unapproved apps or background services cannot leak packets outside the tunnel.

How simplewall Interacts with VPN Virtual Adapters

VPN clients create a virtual TUN/TAP network interface (such as the WireGuard NT adapter or Wintun driver). Because simplewall integrates directly with the Windows Filtering Platform (WFP), it filters packets at both the physical network interface layer and the virtual tunnel layer.

Step 1: Whitelist the VPN Client Executable

Before launching your VPN tunnel:

• Locate your VPN client executable (e.g. wireguard.exe, openvpn.exe, or client services like mullvad-daemon.exe).
• Mark the executable as Allowed in simplewall's Applications list.
• This allows the VPN software to establish the initial encrypted handshake with remote VPN gateways over UDP ports (e.g. 51820 for WireGuard, 1194 for OpenVPN).

Step 2: Permit Wintun / Virtual Adapter Traffic

In Settings > System Rules, verify that:

• Local Area Network (LAN): Enabled, so your PC can negotiate local gateway routes.
• Domain Name System (DNS): Allowed to communicate with your VPN provider's internal DNS servers (e.g., 10.64.0.1).

Building a Bulletproof VPN Kill Switch with simplewall

A kill switch prevents data leaks if the VPN connection unexpectedly drops. With simplewall:

1. In simplewall, select Whitelist Mode.
2. Only authorize your web browsers and apps to communicate via your VPN adapter interface, or allow only the VPN daemon itself to access the physical network interface card.
3. If the VPN tunnel drops, all app sockets are immediately blocked from transmitting unencrypted packets over your plain ISP connection!