Hacker News Reader

Comment by rsync | Hacker News Reader

This is why I use a "slug" when I use a VPN.

A "slug" is a layer-2 bridge, with no IP address configured, that still enforces a TCP/IP whitelist. So it does not "use" a hop on the network route, and you can't see the device, but as it bridges traffic it enforces a (very simple) ruleset.

In my case, I use my own VPN hosts that transact over TCP22 ... and so my network "slug" allows only tcp port 22 traffic. Everything else is blocked.

This means that no matter how badly behaved (or buggy) my VPN software is (I use sshuttle[1]) the bad behavior is blocked by the slug.

The slug itself has almost zero attack surface as it is a BSD based system that has no IP address configured and runs no network services.

I keep meaning to write up a blog entry about this ...

[1] https://sshuttle.readthedocs.io/en/stable/

View on HN

I haven't heard "slug" before, is that your own phrase? It sounds like you've implemented what's known as a stateless transparent firewall if I'm understanding what you've said correctly. Stateless because it's just plain ACLs, transparent because it's not a routed hop/isn't detectable by the client (outside traffic being dropped), and firewall because it's filtering unauthorized traffic. Most people just call it "ACLs" for short though since "stateless transparent firewall" is a bit of a mouthful and "firewall" by itself often implies a routed mode stateful firewall.

"I haven't heard "slug" before, is that your own phrase?"

Yes, although I've been using it for several years when discussing a safety device like this ...

I first discussed a transparent, stateless firewall in 2001 when I wrote a HOWTO for the FreeBSD project:

http://www.kozubik.com/published/freebsd_bridging_ipfw.txt

... although that is hopelessly out of date. Like I said, I keep meaning to do a blog post on this ...

Things like this work great for your own network, but you often want a VPN specifically because the network you're connected to isn't yours, especially for iOS (or Android) devices because they're mobile.

This concept is often referred to as a "VPN killswitch" as well (though that is really a misnomer, IMO).

Popular with pirates because having torrent activity leaked to your ISP is not great.

I may have a VPN box that only allows traffic to one IP via IP tables/nftables. VPN breaks, no traffic. Simple. It’s useful for more than just piracy though. It’s a nice way to shut down all sorts of ISP crap and guarantee no leakage. Run the household DNS though it as well.

This, but if your op-sec is strict enough, have unique DNS servers per security domain; possibly just a simple local caching server that is forced to work through the intended public face.

I guess you could call it a killswitch, but if so it's a very tiny subset of the ways killswitches are implemented.

I just use iptables, and allow only output via eth0/enp0s1 to the VPN server, so everything else must use tun0. Or I use pfSense VMs as VPN gateways, with outbound NAT and analogous rules.

But TFA is about iOS, where none of that is possible. Or at least, I'm not aware that it is.

Another thing. Although most people do work with and without VPNs on a given device, that's extremely iffy. Ideally, you want a device to have never hit the Internet directly, but only through the VPN or whatever that you're using. And using pfSense VPN-gateway VMs, that's very easy to do.

What would be the WiFi equivalent of this? Think a scenario where a road warrior is in need of connecting his or her devices to a public network. It seems my simple OpenVPN setup on each individual device isn’t enough.

How exactly is this different than how tor works?

It's really not related to Tor, or how Tor works at all ...

However you could use it with Tor in just the same way - your Tor-networked device should be talking on only specific network ports and any other "chatter" should be considered a leak ... so you would configure the "slug" to only allow the Tor-generated traffic on the expected ports.

I do not use Tor and don't have specific ports/protocols information on it ...

In my opinion, it's best to use Whonix for Tor, because the Tor process and userland are in separate VMs, or separate Qubes AppVMs. There is no forwarding at all between the Whonix workstation VM and the Internet, via the gateway VM. The workstation VM just uses Tor SocksPorts exposed on the gateway VM, through a private network link.

Where leaving no traces on a device is key, Tails is better, because it runs in RAM and wipes everything during shutdown.

Reply on news.ycombinator.com