They secure and compartmentalize at the VM-level so you can setup a VM to work only over Tor or VPN, and others to work directly over your own network. You can also restrict access to hardware per VM.
sudo pflask --netif=macvlan:enp4s0:net0 tmux
You can't just set your vpn connection as the default route? What's even the point if it's not the default route?
Applications (at least on Linux) have no idea what device they are using. They just request a connection to an IP and it's the kernels job to route that request correctly.
In particular this sentence is complete nonsense:
I'm sick of the idea that Windows perceives an internet connection somehow, hides it from me, and automatically makes it available to everything that asks for "the internet". But I don't actually know how to do this. Someone is working really, really hard to make sure I don't affect who uses what device.
As usual, MS has pretty decent documentation on this: https://docs.microsoft.com/en-us/windows-hardware/drivers/mo...
I don't particularly like the GUI_centric nature of much of it, but the complaint itself is completely ill-informed.
> Applications (at least on Linux) have no idea what device they are using. They just request a connection to an IP and it's the kernels job to route that request correctly.
This is a bad idea. I want to connect the application to the device I think it should use. It shouldn't be able to find anything I don't tell it about.
> This is a bad idea. I want to connect the application to the device I think it should use. It shouldn't be able to find anything I don't tell it about.
Telling applications about resources is literally what the operating system is for. Both Linux and Windows let you do what you want.
I've been coming around to a similar idea. I'd like a setup something like this for my desktop:
1. Some devices representing network connections. One or more are "real"; others may be VPNs.
2. Per-application settings governing which network devices, if any, the application may use. Default to none.
For example, the common way to use a VPN is like this:
1. Start your machine. You're connected to the internet, but not yet to the VPN. All of your running software is already using the internet over the unprotected connection.
2. Start the VPN. It will magically do something such that applications wanting to use "the internet" find it instead of the connection they used to find (the one the VPN itself is still using). All of your running software is now using the VPN. Did you want something to use the other connection? Too bad.
I'm sick of the idea that Windows perceives an internet connection somehow, hides it from me, and automatically makes it available to everything that asks for "the internet". But I don't actually know how to do this. Someone is working really, really hard to make sure I don't affect who uses what device.