You can create Firewall timed groups to restrict Internet access until a client system connects over a VPN.
Select Menu → Policy → Policy Catalog, then select Endpoint Security Firewall from the Products list in the left pane.
From the Category list in the right pane, select Options.
Click the name of an editable policy.
Create a Firewall group with default settings that allow Internet connectivity. For example, allow port 80 HTTP traffic.
In the Schedule section, select how to enable the group.
Enable schedule — Specifies a start and end time for the group to be enabled.
Disable schedule and enable the group from the Trellix system tray icon — Allows users to enable the group from the Trellix system tray icon and keeps the group enabled for the specified number of minutes.
If you allow users to manage the timed group, you can optionally require that they provide a justification before enabling the group.
Create a connection isolation group that matches the VPN network to allow needed traffic.
Tip
To allow outbound traffic from only the connection isolation group on the client system, don't place any Firewall rules below this group.
Click Save.