4 ms·
How hard is it for a firewall to block option 121 (and 33)? Cloudflare WARP made a robust VPN but is not cheap.
by mycall 2y ago
How hard is it for a firewall to block option 121 (and 33)?
Cloudflare WARP made a robust VPN but is not cheap.
- agwa 2y agoIgnoring or blocking these options is trivial but ineffective since the DHCP server can still send a malicious subnet mask. (Edited to replace "default gateway" with "subnet mask")
- peddling-brink 2y agoForgive my ignorance, but what could a malicious gateway do in this instance?
- agwa 2y agoWhoops, I posted too early in the morning, I meant to say "malicious subnet mask" :-) Basically, the DHCP server sends a subnet mask for an absolutely huge subnet (e.g. a /2), and the route for that subnet takes precedence over the VPN route. The attacker can only intercept 25% of the IPv4 address space with a /2 but that's still pretty bad.
- peddling-brink 2y agoClever, thanks!
- gruez 2y agoIt's probably more straightforward to have the firewall block all traffic from using the non-VPN interfaces (ie. blacklist approach) instead. In the other thread[1] there was disagreement about whether commercial VPN services actually implement their 'killswitch" in this way. Apparently NordVPN does not (hearsay), but neither side provided a good survey of other providers. [1] https://news.ycombinator.com/item?id=40279632 https://news.ycombinator.com/item?id=40279632
- felixg3 2y agoCloudflare Warp is free, I think - if you create a Zero Trust Organisation for free and configure the Warp client to use it, you can use unmetered Warp+ with Argo routing without charge.