3 ms·
If you use their wireguard servers, you can use wireguard directly (no Mullvad) app, and this is probably not an issue? I'm not certain and don't have a (modern
by OJFord 3y ago
If you use their wireguard servers, you can use wireguard directly (no Mullvad) app, and this is probably not an issue? I'm not certain and don't have a (modern) Mac, so I can't test. Just a reminder that it's nothing proprietary and the app is optional I suppose.
- derefr 3y agoI would presume that the thing Mullvad are (rightfully) doing with firewall rules in their app, is to prevent non-VPN traffic from flowing whenever the VPN is enabled. The whole “leaking your IP through DNS / privileged connections to OS update servers / etc.” issue.
- OJFord 3y agoI'm not saying there's no value in the app, but there must be other ways of achieving that (though, maybe they're broken by the same). Do you have `ip netns` on macOS? Fwmark? There's the WireGuard app too of course, I wonder if that's similarly broken.
- fastball 3y agoThe way of achieving that is through the Packet Filter, which is what is broken. It seems unlikely you can block system-level traffic with anything except system-level APIs.
- hnarn 3y agoI'm not in any way excusing the bug, but what about routing? Even if the firewall is broken, if you have a wg0 interface and your only route is through that interface, wouldn't that also achieve the same goal?