Hacker News Reader

This type of device is referred to as a “network slug”[1] … and it is a fantastic idea.

If we’re being formal, a true slug is one that has no IP address defined and is a transparent layer two firewall… But we don’t need to pick nits here…

[1] https://john.kozubik.com/pub/NetworkSlug/tip.html

Can a standard linux distribution be configured as a network slug? I'm sick of companies forcing themselves onto people's private information without their consent.

Very cool, didn’t know about this!

  This worked great to ensure that no traffic was leaked from pc to vpn server. The IP address of the VPN server you’re making use of rarely changes or if it does it’s easy enough to change on the MikroTik firewall.  

  Another method is to block all traffic not to the port/protocol pair being used by the VPN server if you don’t know the servers IP address (or if it changes). As an example drop any traffic not dst UDP 1194 (based on the type of VPN, of course).

outbound filtering by source and/or destination address and/or port is both a fundamental firewalling concept and standard configuration on all firewall-routing platforms. (policy-based routing[0], i.e. filtering by gateway, is the same.) generally speaking, only the con/prosumer products allow everything out by default.

just curious, what was your "main router" in this setup? ISP-supplied?

[0] https://en.wikipedia.org/wiki/Policy-based_routing

It was also a mikrotik - so of course, I could’ve done everything on that one.

however, I had to show / prove to a client that the set up could be easily duplicated at other locations (and moved around) where everything else on the network was unknown (only known / controlled parts were to be a Windows laptop, and the mikrotik router connecting ethernet from that laptop to whatever network also via eth.

For some of the configurations that needed to be very portable, the (very low end) MikroTik was powered via USB from the laptop

Customer also wanted the router to log any dropped/leaked traffic (which we did on the mikrotik to it’s internal memory, or a usb stick with a txt file log)

As long as you're promoting them, have they got a good/cheap router with a layer 7 firewall?

If only we could insert a firewall between our apps and the modems in our phones.

Raspberry pi with a second network interface… Running FreeBSD.

As to your other point… If you remove the Sim card from your telephone and then connect to a second router device that you carry with you… But we’re getting a little weird here…

Oh, I am/was there. I have two to three phones anytime on me, so I can route one through the hotspot of the other. Still the question if the second phone route everything through the VPN.

Edit: and GP asked specifically about Mikrotik, I think. They have L7 cap, but it's literally raw.