3 ms·

Presumably this is an OS-level thing, that it helpfully tries to fall back? If so, I suppose it could be mitigated either by a software control that prevents us

Presumably this is an OS-level thing, that it helpfully tries to fall back? If so, I suppose it could be mitigated either by a software control that prevents using the bare connection, or by running the VPN elsewhere, for example on your router. (I see posts elsewhere in the thread now describing how to do this with iptables.)

kobalsky 5y ago
what I heard some naugthy people say is that one way to deal with these kind of issues is to have two virtual machines, one that connects to the vpn and a second one (without host networking) that can only access internet through the first one. the firewall on the gateway vpc has to be on drop by default and only forward traffic from the 2nd vpc to the vpn interface. the gateway vpc should NEVER provide DHCP or DNS to the second vpc since this is the easiest way to shoot your foot off since a single dns request may give your identity away. that or use qubes os.
- Terry_Roll 5y ago
  Even if you did that, if I have oversight of the network in a country, like a 5+ eyes level of oversight and you were in a 5+ eyes country, I'd still be able to see where you are and what you would be doing. Road & Rail networks have a lot in common with digital networks, when you think about it. Personally I'd have a machine in a foreign country and used that either via an app or friend in front of the machine to do the download(s) with a time delay to avoid obvious links and then sneak it back across the border in bits. Insecure home networks can be useful, and there is no limit to the number of times and algo's that can be used to encrypt files Russian Doll style. Foreign country's which do not data share or extradite have their uses, but media like news orgs, Youtube and others can be helpful for establishing what hackers have been extradited. Assume all country's have hackers attacking the US or some other country and then look for missing news stories, YT videos and that sort of thing. Then look into what relations are like between the two country's and go from there. If you do your research or homework there shouldnt be any risks. I dont think the hackers behind this have ever been caught. https://www.bbc.co.uk/iplayer/episode/m0010s10/the-trick https://www.bbc.co.uk/iplayer/episode/m0010s10/the-trick https://web.archive.org/web/20120719071718/http://www.norfolk.police.uk/newsevents/newsstories/2012/july/ueadatabreachinvestigation.aspx https://web.archive.org/web/20120719071718/http://www.norfol...
mercora 5y ago
i use policy routing and let wireguard mark packets it wants to send out. the main table is empty (there is no route... at all..) external connections insert routes into their own tables. the wireguard interface does this too and any packet not marked by wireguard will use this routing table... if wireguard is missing nothing marks packets to leave at external interfaces. i have an additional rule that prohibits any traffic that did not have a route in any table applicable at the end of the policy rules

kobalsky 5y ago

what I heard some naugthy people say is that one way to deal with these kind of issues is to have two virtual machines, one that connects to the vpn and a second one (without host networking) that can only access internet through the first one. the firewall on the gateway vpc has to be on drop by default and only forward traffic from the 2nd vpc to the vpn interface. the gateway vpc should NEVER provide DHCP or DNS to the second vpc since this is the easiest way to shoot your foot off since a single dns request may give your identity away. that or use qubes os.

Terry_Roll 5y ago
Even if you did that, if I have oversight of the network in a country, like a 5+ eyes level of oversight and you were in a 5+ eyes country, I'd still be able to see where you are and what you would be doing. Road & Rail networks have a lot in common with digital networks, when you think about it. Personally I'd have a machine in a foreign country and used that either via an app or friend in front of the machine to do the download(s) with a time delay to avoid obvious links and then sneak it back across the border in bits. Insecure home networks can be useful, and there is no limit to the number of times and algo's that can be used to encrypt files Russian Doll style. Foreign country's which do not data share or extradite have their uses, but media like news orgs, Youtube and others can be helpful for establishing what hackers have been extradited. Assume all country's have hackers attacking the US or some other country and then look for missing news stories, YT videos and that sort of thing. Then look into what relations are like between the two country's and go from there. If you do your research or homework there shouldnt be any risks. I dont think the hackers behind this have ever been caught. https://www.bbc.co.uk/iplayer/episode/m0010s10/the-trick https://www.bbc.co.uk/iplayer/episode/m0010s10/the-trick https://web.archive.org/web/20120719071718/http://www.norfolk.police.uk/newsevents/newsstories/2012/july/ueadatabreachinvestigation.aspx https://web.archive.org/web/20120719071718/http://www.norfol...

mercora 5y ago

i use policy routing and let wireguard mark packets it wants to send out. the main table is empty (there is no route... at all..) external connections insert routes into their own tables. the wireguard interface does this too and any packet not marked by wireguard will use this routing table... if wireguard is missing nothing marks packets to leave at external interfaces. i have an additional rule that prohibits any traffic that did not have a route in any table applicable at the end of the policy rules