It's less that, it's more the fact that you're presenting a standard network connection. Software can do the equivalent of ifconfig | grep addr, software can p

It's less that, it's more the fact that you're presenting a standard network connection. Software can do the equivalent of ifconfig | grep addr, software can print the routing table (and therefore get all gateways) A really basic thing to do would just be to drop all traffic not destined toward your VPN endpoint, so leaks would fail and/or be logged, but this still doesn't solve the fact that _other software running on your computer can enumerate all your interfaces for IPs and MAC addrs and gateways_ If you do it one layer up, you solve the software problem. Software and software on generally on same layer, so equally access, at least in usual conditions