How should I use VPN on a Mac to prevent compromise before the VPN starts?
Here is an approach totally outside of the MacOS X GUI.
Hence this approach of the problem won't interfere with any network
or VPN setting.

Let's say I want to use an IPSEC VPN (based on the use of 500/udp == isakmp &amp; 50/ip == esp).

Create an ipfw configuration file just allowing the required protocols to build the VPN:

/usr/bin/sudo cat &lt;&lt;____eof &gt;/etc/ipfw.vpn.rules
# VPN trafic contention
#
# DHCP
add 00100 permit udp from any to any src-port bootpc dst-port bootps
# DNS
add 01000 permit udp from me to any dst-port domain
add 01010 permit udp from any to me dst-port domain
# isakmp
add 01050 permit udp from me to any dst-port isakmp
add 01060 permit udp from any to me dst-port isakmp
# esp
add 01100 permit esp from me to any
add 01110 permit esp from any to me
# all other ip go to the central black hole
add 20000 deny ip from any to any
____eof


Check that its syntax is OK:

/usr/bin/sudo /sbin/ipfw -n /etc/ipfw.vpn.rules


Install it in the kernel:

/usr/bin/sudo /sbin/ipfw /etc/ipfw.vpn.rules


Check that your OS can reboot, and get its IP address through the
usual DHCP. Check that most of the IP protocols are blocked:

ping www.google.com


Of course, if you want to use a VPN on top of SSL, you will have to
adapt this configuration file (isakmp + esp → https).