NetworkManager Dispatcher Scripts: Can They Secure Public Wi-Fi?

Yes, NetworkManager dispatcher scripts can meaningfully improve your security on public Wi-Fi by automatically applying firewall rules, DNS settings, and VPN connections when you join a network. However, they cannot encrypt your traffic by themselves or protect you from every threat; they are a powerful automation tool, not a complete security solution.

What Are NetworkManager Dispatcher Scripts?

NetworkManager is the default network management service on most Linux distributions. It controls your wired, wireless, and mobile broadband connections. Dispatcher scripts are small executable files that NetworkManager runs automatically when certain network events occur—such as when a connection is activated, deactivated, or when a VPN starts or stops.

These scripts live in /etc/NetworkManager/dispatcher.d/ and must be owned by root, not writable by group or others, and executable. NetworkManager passes two arguments to the script: the interface name (like wlan0) and the event (like up, down, vpn-up, or vpn-down). You can also use environment variables like CONNECTION_ID and CONNECTION_UUID to tailor actions to specific networks.

How Dispatcher Scripts Can Improve Public Wi-Fi Security

Public Wi-Fi is inherently risky because traffic can be intercepted by anyone on the same network. A dispatcher script can automate several protective measures the moment you connect:

• Force a VPN connection: The script can start your VPN client when you join an untrusted network and kill the connection if the VPN fails.
• Set strict firewall rules: Using iptables or nftables, you can block all incoming connections and only allow outgoing traffic through the VPN interface.
• Change DNS servers: Override the network’s DNS with trusted resolvers (like Cloudflare or Quad9) to prevent DNS hijacking.
• Disable network sharing: Stop services like Samba or Avahi that might expose local files or services.
• Enable MAC address randomization: While not a strong privacy measure, it can reduce tracking across networks.

These actions happen automatically, so you don’t have to remember to turn on your VPN or adjust firewall settings every time you sit down at a coffee shop.

What Dispatcher Scripts Cannot Do

It’s important to understand the limits. A dispatcher script cannot:

• Encrypt your traffic by itself. It can only launch a VPN or configure encryption; if you don’t have a VPN installed, the script can’t create one.
• Protect against malware. If your system is already compromised, no network script will help.
• Prevent phishing. A malicious website can still trick you into entering credentials.
• Guarantee the VPN works. If the VPN connection drops, the script must be written to kill the network or block traffic; otherwise, you’ll leak data.

Think of the script as an automated butler: it can lock the doors and draw the curtains, but it can’t stop a burglar who has a key.

How to Write a Basic Security Dispatcher Script

Here’s a simple example that starts a VPN and blocks non-VPN traffic when you join any Wi-Fi network. Save it as /etc/NetworkManager/dispatcher.d/99-security and make it executable with sudo chmod +x.

#!/bin/bash
IF=$1
STATUS=$2

if [ "$STATUS" = "up" ]; then
    # Start your VPN (replace with your actual command)
    nmcli connection up id 'MyVPN' &
    sleep 5
    # Block all incoming and non-VPN outgoing traffic
    iptables -P INPUT DROP
    iptables -P FORWARD DROP
    iptables -P OUTPUT DROP
    iptables -A OUTPUT -o tun0 -j ACCEPT
    iptables -A INPUT -i tun0 -j ACCEPT
    # Allow DHCP and DNS (adjust if using a different DNS)
    iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
    iptables -A OUTPUT -p udp --dport 67 -j ACCEPT
    iptables -A INPUT -p udp --sport 67 -j ACCEPT
fi

if [ "$STATUS" = "down" ]; then
    # Restore default policy
    iptables -P INPUT ACCEPT
    iptables -P FORWARD ACCEPT
    iptables -P OUTPUT ACCEPT
    iptables -F
fi

This script assumes your VPN creates a tun0 interface. You’ll need to adjust the interface name and the VPN connection ID. The firewall rules are deliberately strict: they block everything except the VPN tunnel and essential DHCP/DNS traffic. If the VPN fails, you’ll have no network, which is safer than leaking.

Common Pitfalls and How to Avoid Them

Writing dispatcher scripts can be tricky. Here are common mistakes:

• Not making the script executable or root-owned. NetworkManager silently ignores scripts it can’t run.
• Using sleep incorrectly. NetworkManager doesn’t wait for your script to finish, so if you start a VPN, you may need a short delay before applying firewall rules that depend on the VPN interface.
• Forgetting to handle the vpn-up event. If you start a VPN from the script, the vpn-up event fires later; you might want to apply firewall rules there instead of after a fixed sleep.
• Blocking necessary traffic. Overly aggressive rules can break DHCP, DNS, or captive portal authentication. Many public Wi-Fi networks require you to open a browser and log in; your firewall might block that.
• Not testing. Always test on a safe network first. A script that works on one router may fail on another.

Alternatives and Complementary Tools

Dispatcher scripts are not the only way to secure public Wi-Fi. Consider these alternatives or additions:

• Firewalld with rich rules or zones can achieve similar results without scripting.
• VPN clients with kill switches (like OpenVPN’s block-outside-dns or WireGuard’s PostUp rules) provide built-in protection.
• NetworkManager’s built-in settings allow you to enable MAC randomization and ignore automatic DNS per connection.
• Proxies or Tor can be used instead of a VPN, though they have different threat models.

You can combine dispatcher scripts with these tools for defense in depth. For example, use a dispatcher script to switch your firewalld zone to ‘public’ when on Wi-Fi.

Costs and Maintenance

Dispatcher scripts are free and use no extra resources. The cost is in time: you must write, test, and maintain them. When your system updates, firewall rules or VPN commands might change. You’ll also need to handle edge cases like multiple Wi-Fi networks, Ethernet connections, and VPN failures. If you’re not comfortable with bash and iptables, the learning curve can be steep.

There’s also a risk of locking yourself out if the script misbehaves. Always keep a fallback (like a physical console) and test thoroughly.

Frequently Asked Questions

Do dispatcher scripts work on all Linux distributions?
Yes, as long as you use NetworkManager. Most major distros (Ubuntu, Fedora, Arch, Debian) use it by default. The path /etc/NetworkManager/dispatcher.d/ is standard, though some distros may use a different location like /usr/lib/NetworkManager/dispatcher.d/ for package-managed scripts.

Can I use a dispatcher script to automatically connect to a specific VPN only on public Wi-Fi?
Absolutely. You can check the SSID or connection ID in the script and conditionally start the VPN. For example, if CONNECTION_ID matches your home network, do nothing; otherwise, start the VPN.

What if the VPN connection drops after the script runs?
Your firewall rules may still block traffic, which is good. But if you want to be extra safe, you can write a script that monitors the VPN interface and kills the network if it goes down. This is more complex; consider using a VPN client with a built-in kill switch instead.

Is it safe to use a dispatcher script to flush iptables rules?
It can be, but be careful. Flushing all rules might remove other important rules set by your firewall manager. It’s better to use a dedicated chain or a firewall manager like firewalld that handles rules more dynamically.

Do I need to be root to run dispatcher scripts?
Yes, NetworkManager runs them as root, and they must be owned by root. This gives them full system access, so be careful not to introduce vulnerabilities. Only write scripts you understand.

Related

• Asus ProArt P16 Laptops: Specs, Pros, Cons & Buying Tips
• Analytical Database Engine: What It Does & When to Use
• Solana Transaction Pending or Failing: How to Fix