How can we have an always on VPN

[tophneal]

you should be able to setup your WG server/client with a kill switch. You can certainly also use WG as always on (i think WG calls it On-Demand.) You're unlikely to be able to connect to WG without your network services already up, though. But you can edit the config to add the kill switch. this link should help you get it set up https://www.ivpn.net/knowledgebase/linux...ll-switch/