Its worth noting that to pull off this exploit against a victim you have to both have a VPN account that is on and using the same server as the victim AND trick

Its worth noting that to pull off this exploit against a victim you have to both have a VPN account that is on and using the same server as the victim AND trick the victim into visiting a link on a host that you have connected to that VPN server (with a port forward through to you). It works because the traffic never exits the given VPN server as an internal route exists. The simplest method to fix this as a VNP provider is simply to use a second IP as the exit only IP and force all traffic from clients to leave by it.