2 ms·
I wonder whether this attack also works when the VPN device and VPNed is put in a separate network namespace, which would have its own routing table.
by the8472 7y ago
I wonder whether this attack also works when the VPN device and VPNed is put in a separate network namespace, which would have its own routing table.
- bytK7 7y agoI was thinking the same thing as I read the on the description. I see no reason that a separate VPN namespace would be vulnerable to this attack. The compromised device would be able to spoof packets with whatever IPs it wanted, but they would never be received in a context where the tunnel interface would be directly accessible and therefore the device would never see a response from that address, even if correctly guessed and probed.
- tolleydbg 7y agoThis seems like the most popular solution, but there are concerns that it may disrupt routing, and also does not work on -some- systems.