4 ms·

A few years ago, when I was testing various VPN set ups for a project, one thing I would do is have a MikroTik firewall device (hardware) sit between my compute

by bobbob1921 2y ago

A few years ago, when I was testing various VPN set ups for a project, one thing I would do is have a MikroTik firewall device (hardware) sit between my computer and my main router, it’s only purpose would be to block any traffic, not dst for the IP address of the VPN server that the pc was connecting to. This worked great to ensure that no traffic was leaked from pc to vpn server. The IP address of the VPN server you’re making use of rarely changes or if it does it’s easy enough to change on the MikroTik firewall. Another method is to block all traffic not to the port/protocol pair being used by the VPN server if you don’t know the servers IP address (or if it changes). As an example drop any traffic not dst UDP 1194 (based on the type of VPN, of course). MikroTik routers also have a great little tool called torch that allows you to quickly and easily watch traffic (in addition to of course, supporting packet captures. Mikrotik routers are very reasonably priced and range from as low as $30 up to $3000 - all with no software licenses, and they are very powerful and capable if you know what you’re doing.

nickburns 2y ago
This worked great to ensure that no traffic was leaked from pc to vpn server. The IP address of the VPN server you’re making use of rarely changes or if it does it’s easy enough to change on the MikroTik firewall. Another method is to block all traffic not to the port/protocol pair being used by the VPN server if you don’t know the servers IP address (or if it changes). As an example drop any traffic not dst UDP 1194 (based on the type of VPN, of course). outbound filtering by source and/or destination address and/or port is both a fundamental firewalling concept and standard configuration on all firewall-routing platforms. (policy-based routing[0], i.e. filtering by gateway, is the same.) generally speaking, only the con/prosumer products allow everything out by default. just curious, what was your "main router" in this setup? ISP-supplied? [0] https://en.wikipedia.org/wiki/Policy-based_routing https://en.wikipedia.org/wiki/Policy-based_routing
- bobbob1921 2y ago
  It was also a mikrotik - so of course, I could’ve done everything on that one. however, I had to show / prove to a client that the set up could be easily duplicated at other locations (and moved around) where everything else on the network was unknown (only known / controlled parts were to be a Windows laptop, and the mikrotik router connecting ethernet from that laptop to whatever network also via eth. For some of the configurations that needed to be very portable, the (very low end) MikroTik was powered via USB from the laptop Customer also wanted the router to log any dropped/leaked traffic (which we did on the mikrotik to it’s internal memory, or a usb stick with a txt file log)
autoexec 2y ago
As long as you're promoting them, have they got a good/cheap router with a layer 7 firewall? If only we could insert a firewall between our apps and the modems in our phones.
- rsync 2y ago
  Raspberry pi with a second network interface… Running FreeBSD. As to your other point… If you remove the Sim card from your telephone and then connect to a second router device that you carry with you… But we’re getting a little weird here…
  - justsomehnguy 2y ago
    Oh, I am/was there. I have two to three phones anytime on me, so I can route one through the hotspot of the other. Still the question if the second phone route everything through the VPN. Edit: and GP asked specifically about Mikrotik, I think. They have L7 cap, but it's literally raw.
rsync 2y ago
This type of device is referred to as a “network slug”[1] … and it is a fantastic idea. If we’re being formal, a true slug is one that has no IP address defined and is a transparent layer two firewall… But we don’t need to pick nits here… [1] https://john.kozubik.com/pub/NetworkSlug/tip.html https://john.kozubik.com/pub/NetworkSlug/tip.html
- Zuiii 2y ago
  Can a standard linux distribution be configured as a network slug? I'm sick of companies forcing themselves onto people's private information without their consent.
- bobbob1921 2y ago
  Very cool, didn’t know about this!

nickburns 2y ago

This worked great to ensure that no traffic was leaked from pc to vpn server. The IP address of the VPN server you’re making use of rarely changes or if it does it’s easy enough to change on the MikroTik firewall. Another method is to block all traffic not to the port/protocol pair being used by the VPN server if you don’t know the servers IP address (or if it changes). As an example drop any traffic not dst UDP 1194 (based on the type of VPN, of course). outbound filtering by source and/or destination address and/or port is both a fundamental firewalling concept and standard configuration on all firewall-routing platforms. (policy-based routing[0], i.e. filtering by gateway, is the same.) generally speaking, only the con/prosumer products allow everything out by default. just curious, what was your "main router" in this setup? ISP-supplied? [0] https://en.wikipedia.org/wiki/Policy-based_routing https://en.wikipedia.org/wiki/Policy-based_routing

bobbob1921 2y ago
It was also a mikrotik - so of course, I could’ve done everything on that one. however, I had to show / prove to a client that the set up could be easily duplicated at other locations (and moved around) where everything else on the network was unknown (only known / controlled parts were to be a Windows laptop, and the mikrotik router connecting ethernet from that laptop to whatever network also via eth. For some of the configurations that needed to be very portable, the (very low end) MikroTik was powered via USB from the laptop Customer also wanted the router to log any dropped/leaked traffic (which we did on the mikrotik to it’s internal memory, or a usb stick with a txt file log)

autoexec 2y ago

As long as you're promoting them, have they got a good/cheap router with a layer 7 firewall? If only we could insert a firewall between our apps and the modems in our phones.

rsync 2y ago
Raspberry pi with a second network interface… Running FreeBSD. As to your other point… If you remove the Sim card from your telephone and then connect to a second router device that you carry with you… But we’re getting a little weird here…
- justsomehnguy 2y ago
  Oh, I am/was there. I have two to three phones anytime on me, so I can route one through the hotspot of the other. Still the question if the second phone route everything through the VPN. Edit: and GP asked specifically about Mikrotik, I think. They have L7 cap, but it's literally raw.

rsync 2y ago

This type of device is referred to as a “network slug”[1] … and it is a fantastic idea. If we’re being formal, a true slug is one that has no IP address defined and is a transparent layer two firewall… But we don’t need to pick nits here… [1] https://john.kozubik.com/pub/NetworkSlug/tip.html https://john.kozubik.com/pub/NetworkSlug/tip.html

Zuiii 2y ago
Can a standard linux distribution be configured as a network slug? I'm sick of companies forcing themselves onto people's private information without their consent.
bobbob1921 2y ago
Very cool, didn’t know about this!