6 ms·

Why is a software VPN so difficult to get right? Why are so many of them so poor, or miss certain protocols, or have so many leaks? Casting aside actual "vulne

Why is a software VPN so difficult to get right? Why are so many of them so poor, or miss certain protocols, or have so many leaks? Casting aside actual "vulnerabilities" (like buffer overflows, bad encryption, etc...), why can't a software VPN act just like a hardware VPN? Take every byte of traffic sent to a network device, and tunnel it to another endpoint? I'm assuming there are several major reasons that I don't know about that makes what seems like a really trivial problem super difficult...

magnat 9y ago
> Take every byte of traffic sent to a network device, and tunnel it to another endpoint? You have to set up routing tables to decide which interface to use for which destination address. Obviously you can't direct VPN packets via VPN - that would be circular. They have to use your normal, physical connection to get to your default gateway. But what if your default gateway is also a local DNS server? You can't differentiate protocols in routing table. Hardware VPN have it easier - they already know which packets to tunnel because it has designated hardware port for internal network.
- Klathmon 9y ago
  Interesting. So from yours and the other comment, it sounds like the issue really comes down to not being able to force all applications to use the "VPN interface", while still keeping the "hardware interface" functional so the VPN itself can use it. I can see why it can so quickly become a giant mess... Assuming it's the OS that needs to "fix" this, are there any changes either already made or in the works to better address this use case, or is a hardware VPN still going to be the only "real" way to securely tunnel a system for the foreseeable future?
  - dylz 9y ago
    It's less that, it's more the fact that you're presenting a standard network connection. Software can do the equivalent of ifconfig | grep addr, software can print the routing table (and therefore get all gateways) A really basic thing to do would just be to drop all traffic not destined toward your VPN endpoint, so leaks would fail and/or be logged, but this still doesn't solve the fact that _other software running on your computer can enumerate all your interfaces for IPs and MAC addrs and gateways_ If you do it one layer up, you solve the software problem. Software and software on generally on same layer, so equally access, at least in usual conditions
  - magnat 9y ago
    You can use custom kernel filter on Windows and iptables/netfilter on Linux to allow only one process to access physical interface. I've seen Cisco VPN Client (10 years ago or so) do it - apart from CVPND service, all traffic to/from ethernet was dropped. That included kernel stuff - to the point your PC didn't even respond to ARP packets from anything other than gateway. Of course, introducing custom kernel driver and/or your own mini IP stack is way harder to do in a safe way - that's why it's not usually included. As for Linux solutions - I haven't seen VPN client that used this technique, but I guess it's a lot easier, since all the required userland tools are already there.
- pwdisswordfish2 9y ago
  "You have to set up routing tables..." Not true if using an overlay at layer 2. I use one. In case of any doubt, I am not referring to OpenVPN, OpenSSH or any other software mentioned on HN. The "VPN" interface (/dev/tap) can be assigned an RFC 1918 non-routable IP address. To software, it looks like an "internal network". The user wanting to run servers over the "VPN" binds those servers to the tap interface's IP address when she starts them. VPN is in quotes because what I am using allows users on the private network to connect to each other without going through a "VPN gateway". With a VPN there is usually a "gateway" computer that each user must connect to in order to reach the other users.
dylz 9y ago
Software VPN managing all routes is perfectly fine to network traffic. The network traffic is totally taken. The problem here is OTHER SOFTWARE running on the computer that also has visibility into the OS. For example, browsers with p2p connections will enumerate all network interfaces - including your actual adapter's IP
- mirimir 9y ago
  Yes, and neither routing nor firewall rules will prevent that. The simplest solution is working in VMs, with a VPN client running in the host. VMs have only virtual/internal and VPN IPs, so there's nothing sensitive to leak. Or you can use pfSense VMs as VPN gateways. Indeed, you can use a few of them, to create nested VPN chains. Also Whonix, for Tor connectivity.
the8472 9y ago
It does not even have to be that difficult these days. Create VPN, spin up network namespace, move tunnel interface to network namespace, start resolver in that namespace, start VPN'ed applications in that namespace. if-up scripts for OpenVPN can do this for you[0]. As long as you operate the tunnel interface and the genuine network interface side by side some applications may simply decide to ignore default routes and explicitly bind to specific network interface. There are valid reasons to do so. For proper isolation you need to hide all the non-VPN interfaces. [0] https://www.synkretie.net/writings/easy%20namespaced%20openvpn.html https://www.synkretie.net/writings/easy%20namespaced%20openv...
- QasimK 9y ago
  I was recently exploring this case, where you accurately isolate particular applications to using a VPN. The best guide I found was this one (https://coldfix.eu/2017/01/29/vpn-box/ https://coldfix.eu/2017/01/29/vpn-box/) which goes into more depth and looks at alternative approaches as well.
JetSpiegel 9y ago
"Software VPN" such as OpenVPN has two main use cases fighting each other. The usage you mention is the roadwarrior, where the physical network is untrusted and you want to route all traffic through the server. This is what commercial VPN providers provide. The other use case is routing a set of domains though the tunnel, since the local network is trusted. This is useful when you are at home with your personal computer and want to access the work's LAN, but still want YouTube or large traffic to keep going through the local network. Since you are not exclusively bound to an uplink, you can have multiple VPN of this type connected that "expose" different sets of domains. This is possible if you dig through docs, since everyone and their mother are trying to do the other kind.

magnat 9y ago

> Take every byte of traffic sent to a network device, and tunnel it to another endpoint? You have to set up routing tables to decide which interface to use for which destination address. Obviously you can't direct VPN packets via VPN - that would be circular. They have to use your normal, physical connection to get to your default gateway. But what if your default gateway is also a local DNS server? You can't differentiate protocols in routing table. Hardware VPN have it easier - they already know which packets to tunnel because it has designated hardware port for internal network.

Klathmon 9y ago
Interesting. So from yours and the other comment, it sounds like the issue really comes down to not being able to force all applications to use the "VPN interface", while still keeping the "hardware interface" functional so the VPN itself can use it. I can see why it can so quickly become a giant mess... Assuming it's the OS that needs to "fix" this, are there any changes either already made or in the works to better address this use case, or is a hardware VPN still going to be the only "real" way to securely tunnel a system for the foreseeable future?
- dylz 9y ago
  It's less that, it's more the fact that you're presenting a standard network connection. Software can do the equivalent of ifconfig | grep addr, software can print the routing table (and therefore get all gateways) A really basic thing to do would just be to drop all traffic not destined toward your VPN endpoint, so leaks would fail and/or be logged, but this still doesn't solve the fact that _other software running on your computer can enumerate all your interfaces for IPs and MAC addrs and gateways_ If you do it one layer up, you solve the software problem. Software and software on generally on same layer, so equally access, at least in usual conditions
- magnat 9y ago
  You can use custom kernel filter on Windows and iptables/netfilter on Linux to allow only one process to access physical interface. I've seen Cisco VPN Client (10 years ago or so) do it - apart from CVPND service, all traffic to/from ethernet was dropped. That included kernel stuff - to the point your PC didn't even respond to ARP packets from anything other than gateway. Of course, introducing custom kernel driver and/or your own mini IP stack is way harder to do in a safe way - that's why it's not usually included. As for Linux solutions - I haven't seen VPN client that used this technique, but I guess it's a lot easier, since all the required userland tools are already there.
pwdisswordfish2 9y ago
"You have to set up routing tables..." Not true if using an overlay at layer 2. I use one. In case of any doubt, I am not referring to OpenVPN, OpenSSH or any other software mentioned on HN. The "VPN" interface (/dev/tap) can be assigned an RFC 1918 non-routable IP address. To software, it looks like an "internal network". The user wanting to run servers over the "VPN" binds those servers to the tap interface's IP address when she starts them. VPN is in quotes because what I am using allows users on the private network to connect to each other without going through a "VPN gateway". With a VPN there is usually a "gateway" computer that each user must connect to in order to reach the other users.

dylz 9y ago

Software VPN managing all routes is perfectly fine to network traffic. The network traffic is totally taken. The problem here is OTHER SOFTWARE running on the computer that also has visibility into the OS. For example, browsers with p2p connections will enumerate all network interfaces - including your actual adapter's IP

mirimir 9y ago
Yes, and neither routing nor firewall rules will prevent that. The simplest solution is working in VMs, with a VPN client running in the host. VMs have only virtual/internal and VPN IPs, so there's nothing sensitive to leak. Or you can use pfSense VMs as VPN gateways. Indeed, you can use a few of them, to create nested VPN chains. Also Whonix, for Tor connectivity.

the8472 9y ago

It does not even have to be that difficult these days. Create VPN, spin up network namespace, move tunnel interface to network namespace, start resolver in that namespace, start VPN'ed applications in that namespace. if-up scripts for OpenVPN can do this for you[0]. As long as you operate the tunnel interface and the genuine network interface side by side some applications may simply decide to ignore default routes and explicitly bind to specific network interface. There are valid reasons to do so. For proper isolation you need to hide all the non-VPN interfaces. [0] https://www.synkretie.net/writings/easy%20namespaced%20openvpn.html https://www.synkretie.net/writings/easy%20namespaced%20openv...

QasimK 9y ago
I was recently exploring this case, where you accurately isolate particular applications to using a VPN. The best guide I found was this one (https://coldfix.eu/2017/01/29/vpn-box/ https://coldfix.eu/2017/01/29/vpn-box/) which goes into more depth and looks at alternative approaches as well.

JetSpiegel 9y ago

"Software VPN" such as OpenVPN has two main use cases fighting each other. The usage you mention is the roadwarrior, where the physical network is untrusted and you want to route all traffic through the server. This is what commercial VPN providers provide. The other use case is routing a set of domains though the tunnel, since the local network is trusted. This is useful when you are at home with your personal computer and want to access the work's LAN, but still want YouTube or large traffic to keep going through the local network. Since you are not exclusively bound to an uplink, you can have multiple VPN of this type connected that "expose" different sets of domains. This is possible if you dig through docs, since everyone and their mother are trying to do the other kind.