Linux routing/iptable rules

[carcass09]

I am not sure whether this is a question of routing table, or iptables or both.

I have a working OpenVPN connection from a virtual linux machine to a server in another country. I followed a guide and ip-forwarding is also set-up and working, in that I can access the server-side internet from the virtual linux client.

I wish to use my virtual linux machine as the default gateway for a Windows computer on the LAN in my home, and make it impossible for anyone to tell I am on a VPN. My Windows machine and the virtual linux machine are both connected to a router.

So if the OpenVPN connection drops on the linux machine, we want our rules to be such that no packet is sent to the (normal, non-VPN) internet from my Windows machine.
What is the simplest way to achieve this?
Thanks