4 ms·

I would consider the router untrusted when using a VPN, so blaming it for the attack seems misplaced. I'd go even one step further, and say that unprivileged ap

I would consider the router untrusted when using a VPN, so blaming it for the attack seems misplaced. I'd go even one step further, and say that unprivileged applications using the VPN should have no way of discovering your real IP. Applications not using the VPN shouldn't be able to discover the VPN IP, at minimum not use/leak it by accident (e.g. via webrtc). IMO the safest way to access a VPN is from a VM which is restricted to that VPN. Like whonix, but using a VPN instead of Tor. In theory, deep integration into the OS (like Tails does for Tor) could work, but is much easier to get wrong, especially if you want direct network access for other applications. (Only talking about VPNs used for hiding your IP. Tunneling into a company network via VPN is a very different use-case)

wyager 5y ago
I have a seedbox set up on freebsd with two jails. One jail runs wireguard and pf. The other jail runs transmission. They are connected by a virtual Ethernet cable (epair). The transmission jail can only talk to the internet via the VPN jail, which it is not aware of.
- cassianoleal 5y ago
  I don't use it for torrent but I run Wireguard on my router and have 802.11q VLANs that only routes through each of those interfaces. This way all I need to do is tag packets on whichever device they come from and they only go out via that interface. I also have separate Wi-Fi SSIDs for each of those so changing my exit node is as simple as choosing a different one.
- CodesInChaos 5y ago
  Jails/Containers should be fine as well. Just need to make sure host applications don't see the network interface provided by the VPN gateway, so they don't accidentally leak it (linking it to your real IP). A typical example are browsers when using WebRTC.
  - wyager 5y ago
    FreeBSD Jails using vnets cannot see any of the network interfaces belonging to the host (or other jails), so there's little risk of a compromise that way. The only way (in theory) someone could figure out my IP from this setup is A) if they have a jail escape (unlikely) or B) if I screw up my firewall config and accidentally let some packets through that aren't going straight into the VPN (plausible)

wyager 5y ago

I have a seedbox set up on freebsd with two jails. One jail runs wireguard and pf. The other jail runs transmission. They are connected by a virtual Ethernet cable (epair). The transmission jail can only talk to the internet via the VPN jail, which it is not aware of.

cassianoleal 5y ago
I don't use it for torrent but I run Wireguard on my router and have 802.11q VLANs that only routes through each of those interfaces. This way all I need to do is tag packets on whichever device they come from and they only go out via that interface. I also have separate Wi-Fi SSIDs for each of those so changing my exit node is as simple as choosing a different one.
CodesInChaos 5y ago
Jails/Containers should be fine as well. Just need to make sure host applications don't see the network interface provided by the VPN gateway, so they don't accidentally leak it (linking it to your real IP). A typical example are browsers when using WebRTC.
- wyager 5y ago
  FreeBSD Jails using vnets cannot see any of the network interfaces belonging to the host (or other jails), so there's little risk of a compromise that way. The only way (in theory) someone could figure out my IP from this setup is A) if they have a jail escape (unlikely) or B) if I screw up my firewall config and accidentally let some packets through that aren't going straight into the VPN (plausible)