5 ms·

What is the proper way to ensure 100% bulletproof VPN connections without leakage?

by 41b696ef1113 5y ago

artificialLimbs 5y ago
If you're going to commit multiple felonies: using coffee shop wifi instead of your home connection.
- sgjohnson 5y ago
  While wearing a hoodie and a face mask and probably some other accessories
  - gruez 5y ago
    like this? https://www.freepik.com/free-photo/hacker-with-anonymous-mask_3361166.htm https://www.freepik.com/free-photo/hacker-with-anonymous-mas...
    - JohnJamesRambo 5y ago
      No like this. https://i.ytimg.com/vi/KEkrWRHCDQU/maxresdefault.jpg https://i.ytimg.com/vi/KEkrWRHCDQU/maxresdefault.jpg
- bigmattystyles 5y ago
  And don't buy a latte with a credit card
- rmbyrro 5y ago
  Or maybe think again...
Yeri 5y ago
Assuming you're talking about corporate VPN: not using VPN. Things like BeyondCorp. And obviously take away access once that person left the company. https://beyondcorp.com/ https://beyondcorp.com/ https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/
- sgjohnson 5y ago
  The question was how to stop a VPN from leaking the real IP address when the VPN connection fails.
- mikepurvis 5y ago
  This has nothing to do with a company-supplied VPN. This person was an employee using a third party VPN specifically to hide his identity from Ubiquiti.
  - megous 5y ago
    On his work laptop, lol.
IAmPat 5y ago
Briefly... Internal firewall on your PC, like iptables. Block all ports except the VPN port.
sgjohnson 5y ago
Setting up the local routing table so the main interface routes everything except the VPN connection through the VPN. VPN goes down? No route to host. And there are probably a dozen other ways to stop such leakage too. Most commercial VPN providers these days offer something like this, usually branding a it “kill switch” or something.
- gruez 5y ago
  >Most commercial VPN providers these days offer something like this, usually branding a it “kill switch” or something. seems like surfshark has it, but it isn't very reliable https://www.reddit.com/r/surfshark/comments/r8rfb8/kill_switch_windows_app_problem/ https://www.reddit.com/r/surfshark/comments/r8rfb8/kill_swit...
madars 5y ago
On Linux, use network namespaces https://www.wireguard.com/netns/ https://www.wireguard.com/netns/ . Create a separate VPN namespace and have wgN be the only non-loopback interface there, then run your application in that namespace. This also solves WebRTC-style leaks. Physical isolation is even better (e.g. using a spare Raspberry Pi).
gruez 5y ago
use tor. it's specifically designed to avoid traffic leaks (as long as you don't open an external application). I trust that far more than whatever "killswitch" VPN providers have, or properly implementing a home rolled solution with iptables/network namespaces/raspberry pis. the "bouncing your traffic across 3 servers to obfuscate tracking" is a nice bonus as well.
- judge2020 5y ago
  That wouldn't solve this problem. The VPN issue was a 'killswitch' mode that was turned off, or didn't work 100% of the time. You could encounter the same issue with Tor. They didn't have their IP leak via webrtc or some special protocol, it was the VPN app itself with the bug.
  - gruez 5y ago
    >The VPN issue was a 'killswitch' mode that was turned off, or didn't work 100% of the time. You could encounter the same issue with Tor. No you won't, because tor isn't a VPN. In fact it specifically tells you not to use it with other browsers/applications[1]. It's a combo of a browser + tor client. The browser has its proxy set to the tor client, so the only way it can reach the internet is via tor. Getting that to behave properly is far easier/reliable than trying to get it to work for every application/os/hardware configuration. [1] https://2019.www.torproject.org/docs/faq.html.en#CompatibleApplications https://2019.www.torproject.org/docs/faq.html.en#CompatibleA...
- hanniabu 5y ago
  I'm confident enough that 3 letter agencies control most of the network that I'd feel safer using vpn.
  - gruez 5y ago
    they were able to infiltrate various NGOs (that host tor nodes) and/or set up fake NGOs, but they weren't able to infiltrate and/or set up fake VPN providers?
- 5y ago

What is the proper way to ensure 100% bulletproof VPN connections without leakage?

artificialLimbs 5y ago

If you're going to commit multiple felonies: using coffee shop wifi instead of your home connection.

sgjohnson 5y ago
While wearing a hoodie and a face mask and probably some other accessories
- gruez 5y ago
  like this? https://www.freepik.com/free-photo/hacker-with-anonymous-mask_3361166.htm https://www.freepik.com/free-photo/hacker-with-anonymous-mas...
  - JohnJamesRambo 5y ago
    No like this. https://i.ytimg.com/vi/KEkrWRHCDQU/maxresdefault.jpg https://i.ytimg.com/vi/KEkrWRHCDQU/maxresdefault.jpg
bigmattystyles 5y ago
And don't buy a latte with a credit card
rmbyrro 5y ago
Or maybe think again...

Yeri 5y ago

Assuming you're talking about corporate VPN: not using VPN. Things like BeyondCorp. And obviously take away access once that person left the company. https://beyondcorp.com/ https://beyondcorp.com/ https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/

sgjohnson 5y ago
The question was how to stop a VPN from leaking the real IP address when the VPN connection fails.
mikepurvis 5y ago
This has nothing to do with a company-supplied VPN. This person was an employee using a third party VPN specifically to hide his identity from Ubiquiti.
- megous 5y ago
  On his work laptop, lol.

IAmPat 5y ago

Briefly... Internal firewall on your PC, like iptables. Block all ports except the VPN port.

sgjohnson 5y ago

Setting up the local routing table so the main interface routes everything except the VPN connection through the VPN. VPN goes down? No route to host. And there are probably a dozen other ways to stop such leakage too. Most commercial VPN providers these days offer something like this, usually branding a it “kill switch” or something.

gruez 5y ago
>Most commercial VPN providers these days offer something like this, usually branding a it “kill switch” or something. seems like surfshark has it, but it isn't very reliable https://www.reddit.com/r/surfshark/comments/r8rfb8/kill_switch_windows_app_problem/ https://www.reddit.com/r/surfshark/comments/r8rfb8/kill_swit...

madars 5y ago

On Linux, use network namespaces https://www.wireguard.com/netns/ https://www.wireguard.com/netns/ . Create a separate VPN namespace and have wgN be the only non-loopback interface there, then run your application in that namespace. This also solves WebRTC-style leaks. Physical isolation is even better (e.g. using a spare Raspberry Pi).

gruez 5y ago

use tor. it's specifically designed to avoid traffic leaks (as long as you don't open an external application). I trust that far more than whatever "killswitch" VPN providers have, or properly implementing a home rolled solution with iptables/network namespaces/raspberry pis. the "bouncing your traffic across 3 servers to obfuscate tracking" is a nice bonus as well.

judge2020 5y ago
That wouldn't solve this problem. The VPN issue was a 'killswitch' mode that was turned off, or didn't work 100% of the time. You could encounter the same issue with Tor. They didn't have their IP leak via webrtc or some special protocol, it was the VPN app itself with the bug.
- gruez 5y ago
  >The VPN issue was a 'killswitch' mode that was turned off, or didn't work 100% of the time. You could encounter the same issue with Tor. No you won't, because tor isn't a VPN. In fact it specifically tells you not to use it with other browsers/applications[1]. It's a combo of a browser + tor client. The browser has its proxy set to the tor client, so the only way it can reach the internet is via tor. Getting that to behave properly is far easier/reliable than trying to get it to work for every application/os/hardware configuration. [1] https://2019.www.torproject.org/docs/faq.html.en#CompatibleApplications https://2019.www.torproject.org/docs/faq.html.en#CompatibleA...
hanniabu 5y ago
I'm confident enough that 3 letter agencies control most of the network that I'd feel safer using vpn.
- gruez 5y ago
  they were able to infiltrate various NGOs (that host tor nodes) and/or set up fake NGOs, but they weren't able to infiltrate and/or set up fake VPN providers?
5y ago