Re:Attackers Can Decloak Routing-Based VPNs
by banister on Wednesday May 08, 2024 @04:14AM
(#40295563)
Cool! glad we're on the same page finally :)
Yeah, lots of cool stuff you can do with Linux. just wish that the other OSes were half as good, unfortunately most of them require kernel code to do what would be a simple shell script in linux
What I do is put the VPN client into a tagged network namespace (yes, fwmark), and then have a routing rule that makes everything else use a separate routing table.
The DHCP server inserts rules into the routing table used only by the VPN client.
Doing it that way, all leaks are prevented, and also there's no way to denial-of-service traffic within the tunnel - no matter what routes are pushed, it keeps flowing as normal.
No source NAT is required, only `MANGLE`.