Block everything except VPN

hi, and welcome to the forums. Yes, why not? All you need to do is define the default route in FC to point to the tunnel. On the FGT, you allow traffic to the servers (tunnel -> internal) and " forget" the policy to the internet (tunnel -> wan). That' s all.

Hi Jpp, If you have the one policy as suggested by ede, then regardless if the tunnel goes down or stays up, there will be no internet access allowed. If you don' t create a internal>wan policy, then your users will never have internet access (implicy deny rule kicks in). So just create the internal>vpn rule (specify address/ports) and you should be good to go.

Remember that you have to start FC manually on a remote PC. As long as FC is not started the routes are unchanged. That is, the client will have internet access via it' s router. When FC is started (more precisely: when the tunnel is up), the route to the network behind the tunnel is inserted into the routing table of the client. Often you only specify the private network behind the tunnel (on the FGT' s side) in FC, like ' remote subnet: 192.168.44.0/24' . If you specify ' remote subnet: 0.0.0.0/0' instead, ALL traffic which is not directed at a local target will be sent across the tunnel, especially all internet traffic. ' 0.0.0.0/0' is called the ' default route' . @neonbit: I think you' ve got jpp wrong. The remote clients using FC should have no internet access - that' s got nothing to do with the Fortigate settings. Clients behind the FGT should well have internet access.