Early Access - WireGuard configs - No traffic or DNS query logs stored on VPN servers
LoginView Plans
Linux supported

Kill switch support for Linux wg-quick configs

NoLogVPN can generate a Linux variant of the WireGuard config with firewall rules that block traffic outside the tunnel.

View PlansOpen Dashboard
Linux supportedNo native app requiredAdvanced users

How to use it

Create a device from your dashboard.
In the device-ready window, download the Linux Kill Switch variant.
Save the file as /etc/wireguard/nologvpn.conf.
Bring the tunnel up with sudo wg-quick up nologvpn.
Bring it down with sudo wg-quick down nologvpn.

Important limitations

Requires root privileges, iptables, and ip6tables.
If the tunnel does not start correctly, traffic may remain blocked until you fix the rules or bring the interface down.
Test carefully before relying on it as your only leak-protection control.

Rules included

The downloaded variant adds firewall hooks to the Interface section of the WireGuard config.

# Linux wg-quick kill switch
PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT; ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT; ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
Setup guidesSupport
All PoliciesSupportSupport us