Each connection is NATed through the VPN though and the fact that the port number does not change makes it possible to make inferences about connections a user

Each connection is NATed through the VPN though and the fact that the port number does not change makes it possible to make inferences about connections a user has made through the tunnel and inject arbitrary data into the connections. https://www.usenix.org/system/files/sec21-tolley.pdf https://www.usenix.org/system/files/sec21-tolley.pdf