Hacker News Reader

Comment by martin_a | Hacker News Reader

This is probably the first step of being able to fully enforce geo-blocking, censorship or other legal requirements on Mac OS users without any way around.

View on HN

I wonder what enterprises with managed macbooks would think about this. Internet traffic has to be routed through the company firewall in some corporate networks and this restriction will likely cause the company to ditch Apple.

I already thought the same. Our IT department is probably happy to get rid of the two handful of Mac systems once they have "proof" that those are undermining the network security (when the people use them from mobile hotspots or at home).

I'm not a network person, but couldn't this be relatively easily bypassed just by running the VPN on the router?

Yes, but this isn’t an option that is readily available to everyone.

Yes, you can. However with average user, config router with VPN, proxy is a bit complicated. Bypass firewalls and VPNs on macOS is still terrible by the way.

You can't run the VPN on the router if you don't own the router, which means that you can't protect your device's traffic when you're on the go, using mobile hotspot, or connecting to an ISP-supplied gateway without additional hardware.

If I have a second phone (e.g. Android( running a hotspot, and I enable a VPN on that phone, will the hotspot / shared internet also go through the VPN, or will the hotspot bypass it?

With my device and mobile service provider, the hotspot traffic does not route through the VPN that is active on the Android handset.

Frankly, a fixed "Internet" Service Provider that doesn't provide you with a router (and leaves you the possibility to use your own) and a /48 IPv6 prefix should have no legal right to call that service "Internet" (in a similar way that Internet neutrality has to be legally respected) :

https://www.ripe.net/publications/docs/ripe-690

(Mobile cellular Internet seems to be harder, but is there any reason why user's cell-'modem' can't handle the routing of successive /64 connections ?)

It only works at home. Or you need to always have and take your "router-in-the-middle" wherever you go, this is a way more complicated solution

In the future I think the tech savvy will be doing exactly that - pinefone as a wireless hotspot with wireguard to a anonymised proxy.

... for your own safety.

You can always put a vpn before mac eg using some Cisco or Linux based. Although it is obviously more complicated and expensive.

If this Apple firewall nonsense sticks I can see a market emerge for self-contained USB ethernet/wifi dongles that incorporate a built-in router/firewall with VPN functionality. You could build something like this yourself using an rPI or something similar, but my feeling is there could be a sizable market for a small & cheap off-the-shelf device you just plug in.

Every router I have seen in the past decade has had at least basic VPN functionality built in (L2TP/PPTP).

Yes, but it's only useful when connected to your home LAN where you have control over the router, and even then only if you know how to set it up.

Edit: also not sure if the router I got from my ISP (which I don't use, but I guess 99% of their other customers do since it is non-trivial to replace without losing IPTV) would allow me to configure it as a VPN gateway. Pretty sure it won't considering they try to lock it down as much as possible.

How does it work with IPv6, where there is no (need for) LAN (unless maybe if you're a huge company) ?

I'd do the reverse, block any internet access unless it's over a VPN gateway.

Additionally, block anything by default that wasn't looked up over my DNS proxy and/or uses HTTPS without SNI...

Reply on news.ycombinator.com